Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-6475

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
PostgreSQL

Description

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a PostgreSQL

Default version status: unaffected

  • 18 to < 18.4affected
  • 17 to < 17.10affected
  • 16 to < 16.14affected
  • 15 to < 15.18affected
  • 0 to < 14.23affected

References