ALPINE-CVE-2026-116318: SQL Injection
SQL injection in PostgreSQL pgdump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which deployments are affected?
Only PostgreSQL 18 installations with a minor version earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected, including the listed PostgreSQL 15, 16, and 17 packages.
What access does an attacker need?
The attacker must be able to create database objects that can be included in a pg_dump. Exploitation occurs when a dump containing the crafted object is restored by another user, causing arbitrary SQL to run as that restoring user.
What can be done if an update is not immediately available?
Do not restore dumps that include objects created by untrusted or insufficiently trusted users. Restrict object-creation privileges where possible and treat restores of affected PostgreSQL 18 dumps as potentially executing attacker-controlled SQL.
How can I determine whether a system is vulnerable?
Check the PostgreSQL major and minor version used for pg_dump and restore workflows. Systems running PostgreSQL 18.0 through 18.6 are affected; PostgreSQL 18.7 and versions before 18 are not affected.