high CVSS 8.8

CVE-2026-18408·PostgreSQL vulnerability

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Upgrade PostgreSQL to version 18.6 or later, or apply security patches to versions 17.11, 16.15, 15.19, and 14.24 respectively. This vulnerability allows malicious superusers to inject arbitrary code during database restore operations by bypassing the \restrict metacommand protection. Immediate patching is critical if your PostgreSQL instance accepts connections from untrusted administrators or if dump/restore operations are performed in multi-tenant environments.

sudo dnf update postgresql-server postgresql-contrib postgresql-libs

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed PostgreSQL version: psql --version or SELECT version();
  2. Verify if pg_dump and pg_dumpall binaries are present and in use: which pg_dump && which pg_dumpall
  3. Search PostgreSQL logs for \unrestrict metacommand usage: grep -i 'unrestrict' /var/log/postgresql/*.log
  4. Confirm the patch is applied by checking the minor version matches or exceeds: psql -c 'SELECT version();' | grep -E '(18\.[6-9]|17\.1[1-9]|16\.1[5-9]|15\.1[9-9]|14\.2[4-9])'

FAQ

What is CVE-2026-18408?

This vulnerability allows a malicious superuser to inject executable code into PostgreSQL dump files that runs during restore operations under the privileges of the client user executing psql. It exploits incomplete sanitization of the \unrestrict metacommand, which bypasses the \restrict protection mechanism introduced in the previous CVE-2025-8714 patch.

Is CVE-2026-18408 being actively exploited?

No, there is currently no evidence of active exploitation in the wild, and no public exploit code is available. However, the attack requires privileged access and knowledge of dump file manipulation, making it a targeted risk.

What versions of PostgreSQL are affected by CVE-2026-18408?

PostgreSQL versions 18.0 through 18.5, 17.x before 17.11, 16.x before 16.15, 15.x before 15.19, and 14.x before 14.24 are vulnerable. All actively maintained branches are affected.

How do I check if my server is vulnerable to CVE-2026-18408?

Run psql -c 'SELECT version();' and check if your version is older than 18.6, 17.11, 16.15, 15.19, or 14.24 depending on your branch. If it is, your instance is vulnerable.

Does Defensia detect CVE-2026-18408?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-18408 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-18408. Free for 1 server.

Get started free