ALPINE-CVE-2026-120153: SQL Injection
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs database-level CREATE privilege. Exploitation also depends on a non-bundled extension being installed or used with a vulnerable extension-script substitution pattern.
Are standard PostgreSQL extensions affected?
The issue requires a non-bundled extension with a vulnerable script pattern. The provided information does not identify any specific extension as vulnerable.
Which PostgreSQL releases contain the fix?
Fixed releases are PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier releases in those version lines are affected.
What is the impact if exploitation succeeds?
Successful exploitation can allow arbitrary code execution as the bootstrap superuser. This can compromise confidentiality, integrity, and availability of the database environment.