CVE-2026-6467

A flaw was found in PostgreSQL. An uncontrolled search path issue in extension management allows an authenticated user with database-level CREATE privileges to execute arbitrary code as the database superuser. By altering schemas or specifying crafted schema names during extension installation or...

CVE-2026-6467

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension...

CVE-2026-120490

On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system...

CVE-2026-6467

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension...

EUVD-2026-124434

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension...

CVE-2026-6467

PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable to a schema mishandling issue in extension scripts. An attacker with database-level CREATE privileges can exploit an uncontrolled search path element during CREATE EXTENSION or ALTER EXTENSION operations. By utilizing ...

CVE-2026-6467 PostgreSQL extension script schema mishandling executes arbitrary SQL

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension...

EUVD-2026-124427

SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...

CVE-2026-120153

PostgreSQL is vulnerable to SQL injection in extension-script substitutions through object names. An attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser by using a schema or owner name containing newlines or other special substrings. This vulnerabil...

CVE-2026-120153 PostgreSQL extension-script substitutions allow SQL injection through object names

SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...

CVE-2026-120145

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable...

EUVD-2026-124419

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable...

CVE-2026-120145

PostgreSQL contains a missing authorization vulnerability in its logical replication mechanism (CVE-2026-120145). A compromised publisher can execute arbitrary code as the operating system user running a superuser-owned subscription by naming a system catalog as a replication target. This issue a...

CVE-2026-120145 PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable...

EUVD-2026-124480

On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system...

CVE-2026-120490

On Scalable Platforms , an administrator possessing permissions to edit and install Access Control Policies and NAT rules can exploit a vulnerability to create a NAT rule that redirects traffic to the Gateway's Sync interface . This action bypasses the built-in Sync protection , potentially allow...

CVE-2019-9193-Home-Lab

ENGLISH BELOW CVE-2019-9193 — PostgreSQL COPY FROM PROGRAM RCE Lab นี้จำลองช่องโหว่ CVE-2019-9193 ที่เกิดใน PostgreSQL เวอร์ชัน 9.3 - 11.2 ซึ่งเปิดให้ user ที่เป็น superuser หรือมี role pgexecuteserverprogram สามารถใช้คำสั่ง: COPY ... FROM PROGRAM '' เพื่อรันคำสั่ง OS ได้โดยตรง ส่งผลให้เกิด Remot...

Vulnerability in core server (CVE-2026-120145)

PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a...

PT-2026-145839

SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a...

CVE-2026-6467: n/a PostgreSQL: Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege…

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension...