CVE-2026-116313: PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user
Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pgupgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL 18 installations running a minor version before 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
What access does an attacker need?
An attacker needs database-owner privileges and must be able to create objects that shadow operators in the search path used by vacuumdb. Exploitation occurs when vacuumdb is run with --missing-stats-only against the affected database.
When is the vulnerable code path likely to be used?
The pg_upgrade documentation recommends an affected vacuumdb invocation. Environments performing upgrades and following that guidance should determine whether the command was run against databases owned by untrusted or less-trusted users.
What is the impact of successful exploitation?
A database owner can cause arbitrary SQL to run as the database user executing vacuumdb. The resulting access is limited to the privileges of that vacuumdb-running database user.