CVE-2026-41889: pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Analyzed

AliasesRHSA-2026:15856RHSA-2026:16133UBUNTU-CVE-2026-41889+533 more

Published 08-05-2026Last modified 08-05-2026

Vulnerability summary

CVE-2026-41889 is a critical (CVSS 9.8) vulnerability in jackc pgx. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 2.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

0.36%

0%100%

Low · -0.13 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 5

OPENSUSE-SU-2026:21251-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:25138 SUSE-SU-2026:22575-1 SUSE-SU-2026:2824-1 CGA-RRGR-7XQX-RG3Q

Timeline

08-05-2026
PublishedVulnerability first disclosed.
08-05-2026
Last modifiedVulnerability information updated.

Description

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

CVSS metrics

10 scores · 8 sources · 2 versions

v4.02.3v3.19.8

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

Decrease -0.13 pp

From 0.49% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

amass< 5.1.1-r1
argo-workflow-controller-3.6All versions (No fix recorded)
argo-workflow-controller-3.7< 3.7.14-r0
argo-workflow-controller-4.0< 4.0.5-r0
argo-workflow-controller-fips-3.6All versions (No fix recorded)

argo-workflow-controller-fips-3.7< 3.7.14-r0
argo-workflow-executor-3.6All versions (No fix recorded)
argo-workflow-executor-3.7< 3.7.14-r0
argo-workflow-executor-4.0< 4.0.5-r0
argo-workflow-executor-fips-3.6All versions (No fix recorded)
argo-workflows-3.6All versions (No fix recorded)
argo-workflows-3.7< 3.7.14-r0
argo-workflows-4.0< 4.0.5-r0
argo-workflows-fips-3.6All versions (No fix recorded)
argo-workflows-fips-3.7< 3.7.14-r0
authentik-2025.12-go-server< 2025.12.4-r6
authentik-2026.2-go-server< 2026.2.1-r6
authentik-fips-2025.12-go-server< 2025.12.4-r5
authentik-fips-2026.2-go-server< 2026.2.1-r5
azure-service-operator< 2.18.0-r7
azure-service-operator-fips< 2.18.0-r6
bento< 1.17.0-r2
bento-fips< 1.17.0-r2
caddy< 2.11.2-r13
caddy-fips< 2.11.2-r9
cerbos< 0.51.0-r19
certificate-transparency-fips-trillian-ctserver< 1.3.3-r7
certificate-transparency-trillian-ctserver< 1.3.3-r7
chainloop-control-plane< 1.95.0-r0
chainloop-control-plane-fips< 1.94.1-r1
cloudnative-pg< 1.29.0-r5
cloudnative-pg-fips< 1.29.0-r4
cloudnative-pg-fips-plugins< 1.29.0-r4
cloudnative-pg-plugins< 1.29.0-r5
cloudprober< 0.14.2-r9
cloudprober-fips< 0.14.2-r7
commercial-chainloop-backend< 1.72.2-r0
commercial-expanso-edge< 2.1.19-r0
commercial-grafana-11.6< 11.6.16-r0
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2< 12.2.10-r0
commercial-grafana-12.3< 12.3.8-r0
commercial-grafana-12.4< 12.4.5-r0
dapr-daprd-1.14< 1.14.5-r21
dapr-daprd-1.15< 1.15.14-r3
dapr-daprd-1.16< 1.16.14-r1
dapr-daprd-1.17< 1.17.5-r1
dapr-daprd-fips-1.14< 1.14.5-r20
dapr-daprd-fips-1.15< 1.15.14-r2
dapr-daprd-fips-1.16< 1.16.14-r1
dapr-daprd-fips-1.17< 1.17.5-r1
envoy-gateway-egctl< 1.7.2-r7
envoy-gateway-fips-1.6-egctl< 1.6.7-r11
envoy-gateway-fips-egctl< 1.7.2-r4
falcosidekick< 2.33.0-r5
falcosidekick-fips< 2.33.0-r4
ferretdb< 2.7.0-r15
flyte< 1.16.6-r0
gitaly-18.10< 18.10.4-r3
gitaly-18.11< 18.11.2-r2
gitaly-18.6All versions (No fix recorded)
gitaly-18.7All versions (No fix recorded)
gitaly-18.8All versions (No fix recorded)
gitaly-18.9< 18.9.6-r3
gitaly-fips-18.10< 18.10.4-r1
gitaly-fips-18.11< 18.11.2-r3
gitaly-fips-18.6All versions (No fix recorded)
gitaly-fips-18.7All versions (No fix recorded)
gitaly-fips-18.8All versions (No fix recorded)
gitaly-fips-18.9< 18.9.6-r1
gitlab-container-registry-18.10< 18.10.5-r1
gitlab-container-registry-18.11< 18.11.2-r1
gitlab-container-registry-18.7All versions (No fix recorded)
gitlab-container-registry-18.8All versions (No fix recorded)
gitlab-container-registry-18.9< 18.9.6-r1
gitlab-container-registry-fips-18.10< 18.10.5-r1
gitlab-container-registry-fips-18.11< 18.11.2-r1
gitlab-container-registry-fips-18.7All versions (No fix recorded)
gitlab-container-registry-fips-18.8All versions (No fix recorded)
gitlab-container-registry-fips-18.9< 18.9.6-r1
gitlab-elasticsearch-indexer< 5.14.13-r2
gitlab-elasticsearch-indexer-fips< 5.14.13-r2
gitlab-kas-18.11< 18.11.3-r1
gitlab-kas-fips-18.11< 18.11.2-r2
gitness< 3.3.0-r14
goose< 3.27.0-r6
goose-fips< 3.27.0-r6
gotrue< 2.191.0-r2
gotrue-fips< 2.191.0-r2
grafana-11.5All versions (No fix recorded)
grafana-11.6< 11.6.14.01-r10
grafana-12.0All versions (No fix recorded)
grafana-12.1< 12.1.10.01-r23
grafana-12.2< 12.2.8.01-r9
grafana-12.3< 12.3.6.01-r3
grafana-12.4< 12.4.2-r10
grafana-13.0< 13.0.1-r2
grafana-alloy< 1.17.0-r0
grafana-alloy-fips< 1.17.0-r0
grafana-fips-11.5All versions (No fix recorded)
grafana-fips-11.6< 11.6.14.01-r4
grafana-fips-12.0All versions (No fix recorded)
grafana-fips-12.1All versions (No fix recorded)
grafana-fips-12.2< 12.2.8.01-r4
grafana-fips-12.3< 12.3.6.01-r3
grafana-fips-12.4< 12.4.2-r9
grafana-fips-13.0< 13.0.1-r2
harbor-2.12All versions (No fix recorded)
harbor-2.12-exporterAll versions (No fix recorded)
harbor-2.12-jobserviceAll versions (No fix recorded)
harbor-2.13All versions (No fix recorded)
harbor-2.13-exporterAll versions (No fix recorded)
harbor-2.13-jobserviceAll versions (No fix recorded)
harbor-2.14All versions (No fix recorded)
harbor-2.14-exporterAll versions (No fix recorded)
harbor-2.14-jobserviceAll versions (No fix recorded)
harbor-2.15< 2.15.2-r0
harbor-2.15-exporter< 2.15.2-r0
harbor-2.15-jobservice< 2.15.2-r0
harbor-fips-2.12All versions (No fix recorded)
harbor-fips-2.12-exporterAll versions (No fix recorded)
harbor-fips-2.12-jobserviceAll versions (No fix recorded)
harbor-fips-2.13All versions (No fix recorded)
harbor-fips-2.13-exporterAll versions (No fix recorded)
harbor-fips-2.13-jobserviceAll versions (No fix recorded)
harbor-fips-2.14All versions (No fix recorded)
harbor-fips-2.14-exporterAll versions (No fix recorded)
harbor-fips-2.14-jobserviceAll versions (No fix recorded)
harbor-fips-2.15< 2.15.2-r0
harbor-fips-2.15-exporter< 2.15.2-r0
harbor-fips-2.15-jobservice< 2.15.2-r0
hydra< 26.2.0-r4
hydra-fips< 26.2.0-r4
jitsucom-bulker-bulker< 2.11.913-r24
jitsucom-bulker-sidecar< 2.11.913-r24
jitsucom-bulker-syncctl< 2.11.913-r24
juicefs-1.2< 1.2.5-r10
juicefs-1.3< 1.3.1-r13
k3s< 1.35.3.1-r6
k3s-1.31< 1.31.6.1-r24
k3s-1.32< 1.32.13.1-r14
k3s-1.33< 1.33.10.1-r9
k3s-1.34< 1.34.8.1-r0
k3s-1.35< 1.35.3.1-r9
k3s-static< 1.35.3.1-r6
k3s-static-1.31< 1.31.6.1-r24
k3s-static-1.32< 1.32.13.1-r14
k3s-static-1.33< 1.33.10.1-r9
k3s-static-1.34< 1.34.8.1-r0
k3s-static-1.35< 1.35.3.1-r9
keda-2.17All versions (No fix recorded)
keda-2.17-metrics-apiserverAll versions (No fix recorded)
keda-2.18< 2.18.3-r10
keda-2.18-metrics-apiserver< 2.18.3-r10
keda-2.19-metrics-apiserver< 2.19.0-r12
keda-fips-2.17All versions (No fix recorded)
keda-fips-2.17-metrics-apiserverAll versions (No fix recorded)
keda-fips-2.18< 2.18.3-r7
keda-fips-2.18-metrics-apiserver< 2.18.3-r7
keda-fips-2.19< 2.19.0-r6
keda-fips-2.19-metrics-apiserver< 2.19.0-r6
kine< 0.14.16-r3
kots< 1.130.1-r0 | < 1.131.3-r0
kube-bench< 0.15.0-r8
kube-bench-fips< 0.15.0-r6
kubeflow-pipelines-apiserver< 2.16.0-r17
kuma-cp-2.10All versions (No fix recorded)
kuma-cp-2.11< 2.11.7-r12
kuma-cp-2.7< 2.7.19-r12
kuma-cp-2.9< 2.9.15-r0
kuma-dp-2.10All versions (No fix recorded)
kuma-dp-2.11< 2.11.7-r12
kuma-dp-2.13< 2.13.4-r3
kuma-dp-2.7< 2.7.19-r12
kuma-dp-2.9< 2.9.15-r0
kumactl-2.10All versions (No fix recorded)
kumactl-2.11< 2.11.7-r12
kumactl-2.12< 2.12.3-r13
kumactl-2.13< 2.13.4-r3
kumactl-2.7< 2.7.19-r12
kumactl-2.9< 2.9.15-r0
ldap2pg< 6.5.1-r1
migrateAll versions (No fix recorded) | < 4.19.1-r14
openbao< 2.5.3-r0
openbao-fips< 2.5.3-r0
openfga< 1.14.2-r1
openfga-fips< 1.14.2-r1
opentelemetry-collector-contrib< 0.151.0-r0
opentelemetry-collector-contrib-fips< 0.151.0-r0
ory-kratos< 26.2.0-r5
ory-kratos-fips< 26.2.0-r5
peerdb-flow< 0.36.18-r1
pg_timetable< 6.3.0-r2
pg_timetable-fips< 6.2.0-r8
pgwatch< 5.1.0-r4
rke2-cloud-provider< 1.35.1-r7
rke2-cloud-provider-fips< 1.34.2-r12
rke2-runtime-1.31All versions (No fix recorded)
rke2-runtime-1.32All versions (No fix recorded)
rke2-runtime-1.33< 1.33.11.2.1-r1

Show all 200

1 vendor · 200 products · Showing 200 of 368

References

18 links

github.com/jackc/pgx/security/advisories/GHSA-j88v-2chj-qfwxX Refsource CONFIRMARTICLEREPORTAdvisoryWEBMitigationVendor Advisory
github.com/jackc/pgx/commit/60644f84918a8af66d14a4b0d865d4edafd955daX Refsource MISCARTICLEREPORTFIXWEBPatch
github.com/jackc/pgx/releases/tag/v5.9.2X Refsource MISCARTICLEREPORTWEBRelease Notes
access.redhat.com/errata/RHSA-2026:15856Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-41889REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_15856.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2468307REPORT
www.cve.org/CVERecord?id=CVE-2026-41889AdvisoryREPORT

Show all 18 references

nvd.nist.gov/vuln/detail/CVE-2026-41889AdvisoryOval
access.redhat.com/errata/RHSA-2026:16133Advisory
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16133.jsonAdvisory
ubuntu.com/security/CVE-2026-41889REPORT
security-tracker.debian.org/tracker/CVE-2026-41889Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41889.jsonAdvisory
github.com/jackc/pgxPACKAGE
www.suse.com/security/cve/CVE-2026-41889WEB