↑↓ select↵ open⌫ change scopeOpen full search

PG.CENTER connects PostgreSQL documentation, reference, and ecosystem knowledge. Maintained by Pigsty.

CVE-2026-6638

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

Version Information

Affected branchIntroducedFixed InFix Published
16—16.142026-05-14
17—17.102026-05-14
18—18.42026-05-14

CVSS 3.0

Overall Score3.7
Componentcore server
VectorAV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

First published: 2026-05-14

Historical source observations

These dated records preserve the original source claims separately from the reviewed fix list.

center · 2026-10-03 12:08:35.169032+08

  • PostgreSQL 18 · Original minor coordinate: 4
  • PostgreSQL 17 · Original minor coordinate: 10
  • PostgreSQL 16 · Original minor coordinate: 14

pgweb · 2026-10-03 12:08:55.967155+08

  • PostgreSQL 18 · Original minor coordinate: 4
  • PostgreSQL 17 · Original minor coordinate: 10
  • PostgreSQL 16 · Original minor coordinate: 14

Original security advisory · JSON · All advisories