CVE-2026-18408

Modified Modified - Updated After Analysis

Code Injection in PostgreSQL pg_dump

Publication date: 2026-08-13

Last updated on: 2026-08-29

Assigner: PostgreSQL

Description

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-29

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-18408

EUVD

EUVD-2026-57852

Affected Vendors & Products

Vendor	Product	Version / Range
postgresql	postgresql	From 14.0 (inc) to 14.24 (exc)
postgresql	postgresql	From 15.0 (inc) to 15.19 (exc)
postgresql	postgresql	From 16.0 (inc) to 16.15 (exc)
postgresql	postgresql	From 17.0 (inc) to 17.11 (exc)
postgresql	postgresql	From 18.0 (inc) to 18.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in PostgreSQL involves the psql \unrestrict meta-command allowing a superuser of the origin server to execute arbitrary code on the client system running psql during a database restore. It occurs due to untrusted data inclusion in pg_dump, enabling malicious code injection via the \restrict meta-command input expansion.

Detection Guidance

To detect this vulnerability, check your PostgreSQL version against the affected releases (before 18.5, 17.11, 16.15, 15.19, and 14.24). Run 'pg_dump --version' or 'psql --version' to verify. If using an outdated version, the system is likely vulnerable.

Impact Analysis

An attacker with superuser privileges on the origin server could inject and execute arbitrary code on your system when you restore a database dump. This could lead to unauthorized access, data theft, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update PostgreSQL to versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later to address the vulnerability. Avoid using pg_dump, pg_dumpall, or pg_restore with plain-format dumps until patched.

Hi! I’m here to help you understand CVE-2026-18408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70