ALPINE-CVE-2026-116330: High severity alpine/postgresql15 vulnerability
Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Which installations are affected?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What does an attacker need to exploit this issue?
The attacker needs to control or compromise the origin server supplying a tar-format pg_dump archive and induce a user to restore it with psql. Exploitation executes arbitrary code as the client operating system account that runs psql.
Does exploitation require authentication or user interaction?
No privileges are required by the attacker, but user interaction is required. A user must process the malicious restore data using psql.
What should be prioritized if immediate patching is not possible?
Do not restore tar-format pg_dump archives from untrusted or potentially compromised origin servers using psql. Restrict restore operations to archives obtained from trusted sources until an affected PostgreSQL version is updated.