CVE-2026-6638

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 16.0 through 16.13 PostgreSQL versions 17.0 through 17.9 PostgreSQL versions 18.0 through 18.3

Description SQL injection in logical replication occurs when using the 'ALTER SUBSCRIPTION ... REFRESH PUBLICATION' command. This allows a subscriber table creator to execute arbitrary SQL using the credentials of the subscription's publication side. The execution is triggered during the subsequent REFRESH PUBLICATION operation.

Recommendations Update versions 16.x to 16.14 Update versions 17.x to 17.10 Update versions 18.x to 18.4