CVE-2026-15741: PostgreSQL expression deparse allows SQL injection via EXTRACT argument
PostgreSQL expression deparse allows SQL injection via EXTRACT argument
Other sources
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15741?
CVE-2026-15741 has a high severity rating of 8.8.
What type of vulnerability is CVE-2026-15741?
CVE-2026-15741 is classified as an SQL Injection vulnerability.
How does CVE-2026-15741 affect PostgreSQL users?
CVE-2026-15741 allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition.
Which PostgreSQL versions are affected by CVE-2026-15741?
CVE-2026-15741 affects PostgreSQL versions released before August 13, 2026.
How can I mitigate the risks associated with CVE-2026-15741?
To mitigate CVE-2026-15741, it is recommended to upgrade to the latest version of PostgreSQL that addresses this vulnerability.