CVE-2026-18408: postgresql

CVSS: 8.8v3.1HighModified

AliasesALPINE-CVE-2026-18408RHSA-2026:79009RHSA-2026:79027+3 more

Published 13-08-2026Last modified 29-08-2026

Vulnerability summary

CVE-2026-18408 is a high (CVSS 8.8) vulnerability in postgresql. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 27.7% of scored vulnerabilities.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.36%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 51 · Related 30

MGASA-2026-0347 OPENSUSE-SU-2026:11552-1 OPENSUSE-SU-2026:11553-1 OPENSUSE-SU-2026:11554-1 OPENSUSE-SU-2026:11555-1 OPENSUSE-SU-2026:11565-1+45 more

Timeline

13-08-2026
PublishedVulnerability first disclosed.
29-08-2026
Last modifiedVulnerability information updated.

Description

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS metrics

6 scores · 6 sources · 1 version

v3.18.8

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

-0.01 pp

From 0.36% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Affected systems

Redhat34 products

pg_repack< 0:1.4.6-3.module+el8.5.0+11354+78b3c9c5
pg_repack-debuginfo< 0:1.4.6-3.module+el8.5.0+11354+78b3c9c5
pg_repack-debugsource< 0:1.4.6-3.module+el8.5.0+11354+78b3c9c5
pgaudit< 0:1.4.0-5.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.0-6.module+el8.4.0+11288+c193d6d7
pgaudit-debuginfo< 0:1.4.0-5.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.0-6.module+el8.4.0+11288+c193d6d7

pgaudit-debugsource< 0:1.4.0-5.module+el8.5.0+11354+78b3c9c5 | < 0:1.4.0-6.module+el8.4.0+11288+c193d6d7
postgres-decoderbufs< 0:0.10.0-2.module+el8.5.0+11354+78b3c9c5 | < 0:0.10.0-2.module+el8.4.0+11288+c193d6d7
postgres-decoderbufs-debuginfo< 0:0.10.0-2.module+el8.5.0+11354+78b3c9c5 | < 0:0.10.0-2.module+el8.4.0+11288+c193d6d7
postgres-decoderbufs-debugsource< 0:0.10.0-2.module+el8.5.0+11354+78b3c9c5 | < 0:0.10.0-2.module+el8.4.0+11288+c193d6d7
postgresql< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-contrib< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-contrib-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-debugsource< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-docs< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-docs-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plperl< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plperl-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plpython3< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plpython3-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-pltcl< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-pltcl-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server-devel< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server-devel-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-static< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-test< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-test-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-test-rpm-macros< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade-devel< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade-devel-debuginfo< 0:12.22-1.module+el8.8.0+25013+234c17ba.7 | < 0:12.22-1.module+el8.6.0+25015+eae30833.7 | < 0:12.22-1.module+el8.4.0+24985+ffa880ed.7

Show all 34

Ubuntu7 products

postgresql-10All versions (No fix recorded)
postgresql-12All versions (No fix recorded)
postgresql-14< 14.24-0ubuntu0.22.04.1
postgresql-16< 16.15-0ubuntu0.24.04.1
postgresql-18< 18.6-0ubuntu0.26.04.1

Show all 7

Alpine3 products

postgresql16< 16.15-r0
postgresql17< 17.11-r0
postgresql18< 18.5-r0

Debian3 products

postgresql-15< 15.19-0+deb12u1
postgresql-17< 17.11-0+deb13u1
postgresql-18< 18.6-1

Postgresql1 product

postgresql≥ 14.0, < 14.24 | ≥ 15.0, < 15.19 | ≥ 16.0, < 16.15 | ≥ 17.0, < 17.11 | ≥ 18.0, < 18.5

5 vendors · 48 products

References

17 links

www.postgresql.org/support/security/CVE-2026-18408/ARTICLEREPORTVendor Advisory
security.alpinelinux.org/vuln/CVE-2026-18408Advisory
access.redhat.com/errata/RHSA-2026:79009Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2515303REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79009.jsonAdvisory
access.redhat.com/security/cve/CVE-2026-18408REPORT
www.cve.org/CVERecord?id=CVE-2026-18408AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-18408AdvisoryOval
access.redhat.com/errata/RHSA-2026:79027Advisory

Show all 17 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities