CVE-2026-6475
HIGH EPSS 24.1%
Published May 14, 20261mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
Published May 14, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
24.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-61
Affected Products 5
| Vendor | Product | Version | Range |
|---|---|---|---|
| postgresql | postgresql | * | <14.23 |
| postgresql | postgresql | * | ≥15.0 – <15.18 |
| postgresql | postgresql | * | ≥16.0 – <16.14 |
| postgresql | postgresql | * | ≥17.0 – <17.10 |
| postgresql | postgresql | * | ≥18.0 – <18.4 |
References 1
- postgresql.org https://www.postgresql.org/support/security/CVE-2026-6475/
Remediation
- postgresql.org https://www.postgresql.org/support/security/CVE-2026-6475/