REDHAT-BUG-2572567: SQL Injection

Q: Who is exposed to this issue?

PostgreSQL 18 deployments running a minor version before 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Q: What access does an attacker need to exploit it?

An attacker must be able to create a database object involving an inherited column with a child-local not-null constraint whose name requires quoting. The malicious SQL executes when a dump containing that object is restored by another user.

Q: When does the injected SQL run, and under whose privileges?

The injected SQL runs during restoration of a pg_dump output. It executes as the user performing the restore, so the impact depends on that user's database privileges.

Published Nov 12, 2026

Updated

SQL injection in PostgreSQL pgdump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Affected Software

1 affected component

PostgreSQL pg_dump>=18.0<18.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7

Event History

Nov 12, 2026

Data Sourced

via Red Hat·02:33 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

PostgreSQL 18 deployments running a minor version before 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

What access does an attacker need to exploit it?

An attacker must be able to create a database object involving an inherited column with a child-local not-null constraint whose name requires quoting. The malicious SQL executes when a dump containing that object is restored by another user.

When does the injected SQL run, and under whose privileges?

The injected SQL runs during restoration of a pg_dump output. It executes as the user performing the restore, so the impact depends on that user's database privileges.

REDHAT-BUG-2572567: SQL Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

When does the injected SQL run, and under whose privileges?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

When does the injected SQL run, and under whose privileges?