CVE-2026-15741
Received Received - Intake

SQL Injection in PostgreSQL via EXTRACT() Deparse

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-15741
EUVD
EUVD-2026-57846

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5 (exc)
postgresql postgresql to 17.11 (exc)
postgresql postgresql to 16.15 (exc)
postgresql postgresql to 15.19 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in PostgreSQL affecting the EXTRACT() function's deparse mechanism. It allows an object owner to execute arbitrary SQL commands with superuser privileges by defining a hostile object. The flaw impacts tools like pg_dump and psql commands such as \sf.

Detection Guidance

To detect this vulnerability, check your PostgreSQL version against affected releases (14.24, 15.19, 16.15, 17.11, 18.5). Run 'SELECT version();' in psql to see your version. If using an older version, the system is likely vulnerable.

Impact Analysis

An attacker with object ownership could gain full superuser access to the database, leading to data theft, modification, or deletion. It could also disrupt database operations via tools like pg_dump or psql commands that rely on expression deparsing.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Immediately upgrade PostgreSQL to a patched version (14.24, 15.19, 16.15, 17.11, or 18.5). Avoid creating or modifying objects with untrusted definitions until patched. Review user permissions to limit object ownership rights.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15741. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart