CVE-2026-15741

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24

Description An SQL injection exists in the EXTRACT() deparse functionality. This allows an object owner to execute arbitrary SQL commands with superuser privileges by using a hostile object definition. The issue impacts expression deparse consumers, including the pg dump utility, psql commands such as sf, and similar implementations in non-core tools.

Recommendations Update to version 18.5 or later. Update to version 17.11 or later. Update to version 16.15 or later. Update to version 15.19 or later. Update to version 14.24 or later.