CVE-2026-18408

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24

Description Untrusted data inclusion in pg dump, pg dumpall, and pg restore (when generating plain-format dumps) allows a malicious superuser of the origin server to inject arbitrary code. This code is executed by the client operating system account running psql during the restore process via psql restrict meta-command input expansion. Although restrict and unrestrict were introduced to block this attack, the unrestrict command itself was found to be sufficient for exploitation.

Recommendations Update PostgreSQL to version 18.5 or later. Update PostgreSQL to version 17.11 or later. Update PostgreSQL to version 16.15 or later. Update PostgreSQL to version 15.19 or later. Update PostgreSQL to version 14.24 or later.