AZL-113735: CVE-2026-116330 affecting package postgresql 16.15-1
Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier releases in those major-version branches are affected.
What level of access does an attacker need to exploit this?
The attack requires a compromised origin server and a client that restores a tar-format dump using psql. Successful exploitation runs arbitrary code as the operating-system account that runs psql on the client.
Is the listed PostgreSQL 16.15-1 package affected?
Yes. PostgreSQL 16.15 is earlier than the fixed 16.16 release and is therefore affected.