CVE-2026-116325: PostgreSQL reindexdb index name quoting allows SQL injection
SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL 17 releases before 17.12 and PostgreSQL 18 releases before 18.7 are affected. Versions before PostgreSQL 17 are unaffected.
What must an attacker be able to do to exploit this?
The attacker must be able to create an object with a crafted index name. Exploitation also requires reindexdb to be run with both --jobs and --index, and the vulnerable catalog query to process that index name.
What level of access could an attacker gain?
A successful attack can execute arbitrary SQL as the database user running reindexdb. The impact therefore depends on the privileges of that database user.
What should be avoided until updates are installed?
Avoid running reindexdb with --jobs together with --index against databases where untrusted users can create objects. Update affected PostgreSQL 17 installations to 17.12 or later and PostgreSQL 18 installations to 18.7 or later.