CVEFinder.io

CVE-2026-6638

ℹī¸ low
🔍 Scan for this CVE
Summary

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

CVSS Score
3.7
Low
EPSS Score
0.0
Exploit Probability
Published Date
2026-05-14
First Seen: 2026-05-17
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 3.9% of all 349,494 vulnerabilities in our database.

#335,912
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: May 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
🏆 Discovered By
The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this problem.
SSVC data provided by CISA
Last Modified 2026-05-18
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CWE IDs (Weakness Types)
CWE-89

đŸ“Ļ Affected Products 3

Vendor Product Status Affected Versions
postgresql postgresql Affected
> 16.0 < 16.14
postgresql postgresql Affected
> 17.0 < 17.10
postgresql postgresql Affected
> 18.0 < 18.4

🔗 References 1

https://www.postgresql.org/support/security/CVE-2026...
Patch Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-14662 ⚠ī¸ high 8.8 0.5 Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause ... 2026-08-13
CVE-2026-14663 đŸ”ļ medium 6.5 0.1 Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of ... 2026-08-13
CVE-2026-14664 ⚠ī¸ high 8.8 0.4 Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user... 2026-08-13
CVE-2026-14666 đŸ”ļ medium 4.2 0.2 Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query ... 2026-08-13
CVE-2026-14668 ⚠ī¸ high 8.1 0.3 Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a cal... 2026-08-13
CVE-2026-14669 ⚠ī¸ high 8.8 0.6 Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code... 2026-08-13
These CVEs affect the same products