CVE-2026-18408: PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client
PostgreSQL psql \unrestrict lets superuser of pgdump origin server execute arbitrary code in psql client
Other sources
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pgdumpall is also affected. pgrestore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15-1 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.6 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.11 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.15 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.19 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.24 - Compensating control
For psql clients used with pg_dump/pg_dumpall/pg_restore, ensure the client does not allow restrict/ unrestrict meta-command input expansion to process untrusted data; prevent any untrusted or attacker-controlled input from reaching psql restrict meta-command handling during restore (including plain-format dumps used with pg_restore).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18408?
The severity of CVE-2026-18408 is high with a score of 8.8.
How do I fix CVE-2026-18408?
To fix CVE-2026-18408, it is recommended to update your PostgreSQL installation to the latest version that addresses this vulnerability.
What impact does CVE-2026-18408 have on PostgreSQL users?
CVE-2026-18408 allows a malicious superuser to execute arbitrary code on the client's operating system during restore operations with pg_dump.
Who is affected by CVE-2026-18408?
Users of PostgreSQL psql and pg_dump who have a superuser on the origin server are affected by CVE-2026-18408.
When was CVE-2026-18408 published?
CVE-2026-18408 was published on August 13, 2026.