ALPINE-CVE-2026-116313: High severity alpine/postgresql15 vulnerability
Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pgupgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
postgresql/postgresqlto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A database owner can exploit it by creating objects that shadow operators used by vacuumdb's --missing-stats-only catalog query. Exploitation targets the database user account that runs vacuumdb.
Are PostgreSQL installations before version 18 affected?
No. Versions before PostgreSQL 18 are unaffected; within PostgreSQL 18, releases before 18.7 are affected.
When is a deployment exposed?
Exposure requires vacuumdb to be run with --missing-stats-only against a database where an untrusted database owner can create shadowing operators. The pg_upgrade documentation recommends an affected vacuumdb invocation.