REDHAT-BUG-2572543: High severity PostgreSQL vacuumdb vulnerability

Q: Which deployments are affected?

Only PostgreSQL 18 installations running a minor version earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected.

Q: What access does an attacker need?

The attacker must be a database owner and must be able to cause vacuumdb to run against the affected database. Exploitation relies on shadowing operators used by vacuumdb's --missing-stats-only catalog query.

Q: When is the vulnerable code path used?

The issue is triggered when vacuumdb is invoked with --missing-stats-only. The pg_upgrade documentation recommends an affected vacuumdb invocation, making upgrade-related maintenance a relevant exposure scenario.

Q: What is the impact of successful exploitation?

A database owner can execute arbitrary SQL with the privileges of the database user running vacuumdb.

Published Nov 12, 2026

Updated

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pgupgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Affected Software

1 affected component

PostgreSQL vacuumdb>=18.0<18.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7

Event History

Nov 12, 2026

Data Sourced

via Red Hat·02:32 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Only PostgreSQL 18 installations running a minor version earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected.

What access does an attacker need?

The attacker must be a database owner and must be able to cause vacuumdb to run against the affected database. Exploitation relies on shadowing operators used by vacuumdb's --missing-stats-only catalog query.

When is the vulnerable code path used?

The issue is triggered when vacuumdb is invoked with --missing-stats-only. The pg_upgrade documentation recommends an affected vacuumdb invocation, making upgrade-related maintenance a relevant exposure scenario.

What is the impact of successful exploitation?

A database owner can execute arbitrary SQL with the privileges of the database user running vacuumdb.

REDHAT-BUG-2572543: High severity PostgreSQL vacuumdb vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

When is the vulnerable code path used?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

When is the vulnerable code path used?

What is the impact of successful exploitation?