CVE-2026-116313 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's vacuumdb tool trusts an unsafe search path, so a database owner can shadow operators used in its --missing-stats-only catalog query. The shadowed code runs as the database user who runs vacuumdb, which can be a superuser or an admin account.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only PostgreSQL 18 minor versions before 18.7 are affected; earlier major versions are not. The risk applies when vacuumdb runs with --missing-stats-only as an account that other database owners could influence, such as during pg_upgrade follow-up steps. Teams that run vacuumdb only as a trusted maintenance user on databases they fully control have lower exposure.
Not affected if patched-18.7-or-later, postgresql-17-or-older
Who cares database-admins, postgresql, postgresql-18, self-hosted
psql -c "SHOW server_version;" or vacuumdb --version and compare against the fixed release.--missing-stats-only, including from pg_upgrade guidance or scheduled jobs.18.7 or later.Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.