CVE-2026-116313
Received Received - Intake

Untrusted Search Path in PostgreSQL vacuumdb

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: PostgreSQL

Description
Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-116313
EUVD
EUVD-2026-124493

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 18.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116313 is a vulnerability in PostgreSQL's vacuumdb tool where the --missing-stats-only option allows a database owner to execute arbitrary SQL commands as the user running vacuumdb. This happens because of an untrusted search path that enables operator shadowing in the catalog query.

Detection Guidance

Check PostgreSQL version with 'psql --version' or 'SELECT version();'. If running PostgreSQL 18.x before 18.7, the system is potentially vulnerable. Review vacuumdb usage in scripts or cron jobs for --missing-stats-only flag.

Impact Analysis

An attacker with database owner privileges could execute arbitrary code, potentially leading to data breaches, unauthorized modifications, or service disruption. The impact includes high confidentiality, integrity, and availability risks as indicated by the CVSS score of 7.2.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade PostgreSQL to version 18.7, 17.12, 16.16, 15.20, 14.25, or 19 RC 2 immediately. Remove or audit any use of --missing-stats-only in vacuumdb commands. Restrict database owner privileges until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116313. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...