Loading vulnerability…
SQL Injection in PostgreSQL pg_createsubscriber
CVE-2026-6476 is an SQL injection vulnerability in PostgreSQL's pg_createsubscriber utility. Subscription names are inserted into SQL commands without proper quoting, allowing attacker-controlled names to introduce arbitrary SQL. An attacker with pg_create_subscription rights can exploit the flaw to execute SQL with database superuser privileges when pg_createsubscriber next runs. PostgreSQL 17 releases before 17.10 and PostgreSQL 18 releases before 18.4 are affected; versions before PostgreSQL 17 are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation escalates an attacker's database privileges to arbitrary SQL execution as a PostgreSQL superuser. This permits unauthorized access to and modification of database data, changes to database roles and permissions, and destructive operations that can disrupt database availability.
If you can’t patch tonight, do this now.
Until patched, restrict pg_create_subscription rights to trusted roles and prevent untrusted subscription names from reaching pg_createsubscriber. Defer running the vulnerable utility where attacker-controlled subscription names may be processed. These measures reduce exposure but do not replace the update; no vulnerability-specific vendor workaround is identified.
Patch, then assume compromise.
Upgrade PostgreSQL 17 to version 17.10 or later, or PostgreSQL 18 to version 18.4 or later. Alternatively, install distribution-provided packages containing the fix for CVE-2026-6476. Ensure the pg_createsubscriber executable used by operational workflows is updated. The fix properly quotes subscription names before inserting them into SQL commands.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.