CVE-2026-116318: PostgreSQL pg_dump not-null constraint name allows SQL injection
SQL injection in PostgreSQL pgdump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL pg_dumpto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which deployments are affected?
Only PostgreSQL 18 installations running a minor version earlier than 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
What conditions are required for exploitation?
An attacker must be able to create a database object that includes an inherited column with a child-local not-null constraint whose name requires quoting. The malicious SQL executes when a dump containing that object is restored.
Which account is at risk during exploitation?
The arbitrary SQL runs as the user performing the restore. Restore accounts with broad database privileges therefore present the greatest exposure.
What can be done if upgrading is not immediately possible?
Do not restore pg_dump output from databases where untrusted users can create objects, particularly when restoring as a privileged user. Use a restore account with the minimum required privileges until PostgreSQL is updated to 18.7 or later.