Loading vulnerability…
SQL Injection in PostgreSQL Logical Replication Publication Refresh
CVE-2026-6638 is an SQL injection vulnerability in PostgreSQL logical replication origin checks performed by ALTER SUBSCRIPTION ... REFRESH PUBLICATION. Schema and relation names are interpolated into SQL commands without proper identifier quoting. A subscriber-side table creator can use crafted object names to cause arbitrary SQL to execute on the publisher with the subscription's publication-side credentials when the next publication refresh occurs. Affected releases are PostgreSQL 16 before 16.14, 17 before 17.10, and 18 before 18.4. PostgreSQL versions before 16 are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the publisher database within the permissions of the subscription's publication-side account. Injected SQL can access or modify data and perform other operations authorized to that account, potentially affecting confidentiality, integrity, and availability. The extent of compromise depends on the account's privileges; operating-system command execution and unrestricted database administration are not established consequences.
If you can’t patch tonight, do this now.
No vulnerability-specific vendor workaround is documented. Pending upgrade, avoid REFRESH PUBLICATION operations involving subscriber objects whose names can be controlled by untrusted users, and restrict table-creation privileges on the subscriber. Limit the publication-side connection role to necessary privileges to reduce the consequences of injected SQL.
Patch, then assume compromise.
Upgrade PostgreSQL 16 to 16.14 or later, PostgreSQL 17 to 17.10 or later, or PostgreSQL 18 to 18.4 or later within the corresponding release branch. The fix properly quotes schema and relation names in logical replication origin checks. For embedded PostgreSQL deployments, apply a vendor-supported product update incorporating a fixed PostgreSQL release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.