CVE-2026-14661: PostgreSQL dblink and subscriptions can append to arbitrary files
External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL 18 minor versions before 18.7 are affected. Earlier PostgreSQL major versions are also affected when the server has libpq version 18 or later installed and in use.
What level of access does an attacker need?
An attacker needs privileges to use dblink or to issue CREATE SUBSCRIPTION or ALTER SUBSCRIPTION statements. Exploitation does not require user interaction and can be performed remotely.
What is the practical impact of successful exploitation?
The attacker can cause NSS keylog-format data to be appended to a file they choose, potentially corrupting that file and causing persistent denial of service. The mechanism cannot write arbitrary byte sequences.
How can I determine whether an older PostgreSQL major version is exposed?
Check whether the server is using libpq version 18 or later. Earlier major versions are affected only under that condition.