CVEFinder.io

CVE-2026-6476

⚠️ high
🔍 Scan for this CVE
Summary

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS Score
7.2
High
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-14
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 54.4% of all 349,476 vulnerabilities in our database.

#159,188
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
The PostgreSQL project thanks Yu Kunpeng for reporting this problem.
SSVC data provided by CISA
Last Modified 2026-05-18
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-89

📦 Affected Products 2

Vendor Product Status Affected Versions
postgresql postgresql Affected
> 17.0 < 17.10
postgresql postgresql Affected
> 18.0 < 18.4

🔗 References 1

https://www.postgresql.org/support/security/CVE-2026...
Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-14662 ⚠️ high 8.8 0.5 Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause ... 2026-08-13
CVE-2026-14663 🔶 medium 6.5 0.1 Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of ... 2026-08-13
CVE-2026-14664 ⚠️ high 8.8 0.4 Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user... 2026-08-13
CVE-2026-14666 🔶 medium 4.2 0.2 Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query ... 2026-08-13
CVE-2026-14668 ⚠️ high 8.1 0.3 Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a cal... 2026-08-13
CVE-2026-14669 ⚠️ high 8.8 0.6 Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code... 2026-08-13
These CVEs affect the same products