UBUNTU-CVE-2026-120153: SQL Injection
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs database-level CREATE privilege. Exploitation also requires a non-bundled extension whose installation script uses the vulnerable substitution pattern.
Are default PostgreSQL extensions affected?
The issue requires a non-bundled extension with a vulnerable script pattern; the provided information does not identify bundled extensions as affected.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary code as the bootstrap superuser, which can compromise confidentiality, integrity, and availability of the PostgreSQL instance.
Which PostgreSQL releases need updating?
Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Update to the applicable listed release or later.