high CVSS 7.2 EPSS 0.29%

CVE-2026-6476·PostgreSQL vulnerability

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

Severity
high
Software
PostgreSQL
Fixed in
18.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.29% — higher than 20% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-6476 scores 7.2 on CVSS, so a successful attack would be serious — but at 0.29%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.4

Fixed in: 18.4

How to fix this CVE

Upgrade PostgreSQL to version 18.4 or later to patch the SQL injection vulnerability in pg_createsubscriber. Organizations running PostgreSQL 18.0–18.3 should prioritize this update, as the vulnerability allows authenticated users with subscription creation privileges to execute arbitrary SQL commands with superuser permissions. After patching, verify the fix was applied and monitor for any suspicious subscription-related activity in your logs.

sudo dnf update postgresql-server postgresql-contrib postgresql-libs

Defensia detects this vulnerability

How to check if you are affected

  1. Run `psql --version` or connect to PostgreSQL and execute `SELECT version();` to confirm the installed version—versions 18.0 through 18.3 are vulnerable.
  2. Query the pg_subscription system catalog with `SELECT * FROM pg_subscription;` to identify any subscriptions created by non-superuser accounts with pg_create_subscription role privileges.
  3. Search PostgreSQL logs (typically in /var/log/postgresql/ on Linux) for errors or warnings related to pg_createsubscriber execution, particularly unexpected SQL statements or CREATE SUBSCRIPTION commands executed by privileged users.
  4. After upgrading to version 18.4, re-run `SELECT version();` and verify the minor version is 18.4 or higher; then restart the PostgreSQL service with `sudo systemctl restart postgresql` to ensure the patched binary is in use.

FAQ

What is CVE-2026-6476?

CVE-2026-6476 is a SQL injection flaw in PostgreSQL's pg_createsubscriber utility that allows users with subscription creation rights to inject malicious SQL code, which executes with superuser privileges when pg_createsubscriber runs. This enables unauthorized data access, modification, or system compromise by an authenticated attacker.

Is CVE-2026-6476 being actively exploited?

No, CVE-2026-6476 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available. However, the high CVSS score (7.2) indicates the need for prompt patching regardless of active exploitation status.

What versions of PostgreSQL are affected by CVE-2026-6476?

PostgreSQL versions 18.0, 18.1, 18.2, and 18.3 are vulnerable. Version 18.4 contains the fix. PostgreSQL 17 and earlier major versions are unaffected by this vulnerability.

How do I check if my server is vulnerable to CVE-2026-6476?

Connect to PostgreSQL and run `SELECT version();`—if the output shows version 18.0–18.3, your server is vulnerable and requires immediate upgrade to 18.4 or later.

Does Defensia detect CVE-2026-6476?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6476 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-15742CVSS 8.8Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-16238CVSS 8.8Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6476. Free for 1 server.

Get started free