{"id":"CVE-2026-116313","kind":"vulnerability","aliases":["CVE-2026-116313"],"related":[],"title":"PostgreSQL: vacuumdb search path lets a database owner run SQL","description":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query.  The pg_upgrade documentation recommends an affected vacuumdb invocation.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected.","summary":"PostgreSQL's vacuumdb tool trusts an unsafe search path, so a database owner can shadow operators used in its --missing-stats-only catalog query. The shadowed code runs as the database user who runs vacuumdb, which can be a superuser or an admin account.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admins","postgresql","postgresql-18","runtime","self-hosted"],"not_affected_if":["patched-18.7-or-later","postgresql-17-or-older"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` or `vacuumdb --version` and compare against the fixed release.\n- Check whether vacuumdb is run with `--missing-stats-only`, including from pg_upgrade guidance or scheduled jobs.","fix":"- PostgreSQL 18: upgrade to `18.7` or later.","status":"open","published_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:52+00:00","updated_at":"2026-11-12T15:43:52+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:52Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: upgrade to `18.7` or later.","reach":"local","title":"PostgreSQL: vacuumdb search path lets a database owner run SQL","impact":"high","summary":"PostgreSQL's vacuumdb tool trusts an unsafe search path, so a database owner can shadow operators used in its --missing-stats-only catalog query. The shadowed code runs as the database user who runs vacuumdb, which can be a superuser or an admin account.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","postgresql-18","self-hosted","database-admins"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary SQL as the vacuumdb database user","analyst_note":"Confirm the exact fixed version list and whether the fix is named in the NVD or PostgreSQL release notes; sources only give 18.7 as the threshold.","how_to_check":"- Run `psql -c \"SHOW server_version;\"` or `vacuumdb --version` and compare against the fixed release.\n- Check whether vacuumdb is run with `--missing-stats-only`, including from pg_upgrade guidance or scheduled jobs.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["postgresql-17-or-older","patched-18.7-or-later"],"who_is_affected":"Only PostgreSQL 18 minor versions before 18.7 are affected; earlier major versions are not. The risk applies when vacuumdb runs with --missing-stats-only as an account that other database owners could influence, such as during pg_upgrade follow-up steps. Teams that run vacuumdb only as a trusted maintenance user on databases they fully control have lower exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000795,"input_tokens":4609,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116313':13A,16A '-18':22B '-2026':12A,15A '18':116C,127C '18.7':121C 'account':71B 'admin':19B,70B 'affect':110C,123C 'allow':78C 'arbitrari':84C 'catalog':50B,102C 'code':54B 'cve':11A,14A 'databas':7A,18B,38B,58B,80C,88C 'database-admin':17B 'document':107C 'execut':83C 'host':26B 'invoc':112C 'let':5A 'major':114C 'minor':117C 'miss':47B,99C 'missing-stats-on':46B,98C 'oper':42B,94C 'owner':8A,39B,81C 'path':4A,35B,74C 'pg':105C 'postgresql':1A,20B,21B,27B,76C,120C,126C 'queri':51B,103C 'recommend':108C 'run':9A,55B,61B,90C 'runtim':23B 'search':3A,34B,73C 'self':25B 'self-host':24B 'shadow':41B,53B,93C 'sql':10A,85C 'stat':48B,100C 'superus':67B 'tool':30B 'trust':31B 'unaffect':129C 'unsaf':33B 'untrust':72C 'upgrad':106C 'use':43B,95C 'user':59B,89C 'vacuumdb':2A,29B,62B,77C,91C,111C 'version':115C,118C,124C 'via':92C 'within':113C","nicknames":[],"mitigations":[],"who_affected":"Only PostgreSQL 18 minor versions before 18.7 are affected; earlier major versions are not. The risk applies when vacuumdb runs with --missing-stats-only as an account that other database owners could influence, such as during pg_upgrade follow-up steps. Teams that run vacuumdb only as a trusted maintenance user on databases they fully control have lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databaseadmins","high","postgresql","postgresql18","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116313':13A,16A '-2026':12A,15A 'cve':11A,14A 'databas':7A 'let':5A 'owner':8A 'path':4A 'postgresql':1A 'run':9A 'search':3A 'sql':10A 'vacuumdb':2A","search_b":"'-18':22B 'account':71B 'admin':19B,70B 'catalog':50B 'code':54B 'databas':18B,38B,58B 'database-admin':17B 'host':26B 'miss':47B 'missing-stats-on':46B 'oper':42B 'owner':39B 'path':35B 'postgresql':20B,21B,27B 'queri':51B 'run':55B,61B 'runtim':23B 'search':34B 'self':25B 'self-host':24B 'shadow':41B,53B 'stat':48B 'superus':67B 'tool':30B 'trust':31B 'unsaf':33B 'use':43B 'user':59B 'vacuumdb':29B,62B","search_c":"'18':116C,127C '18.7':121C 'affect':110C,123C 'allow':78C 'arbitrari':84C 'catalog':102C 'databas':80C,88C 'document':107C 'execut':83C 'invoc':112C 'major':114C 'minor':117C 'miss':99C 'missing-stats-on':98C 'oper':94C 'owner':81C 'path':74C 'pg':105C 'postgresql':76C,120C,126C 'queri':103C 'recommend':108C 'run':90C 'search':73C 'shadow':93C 'sql':85C 'stat':100C 'unaffect':129C 'untrust':72C 'upgrad':106C 'use':95C 'user':89C 'vacuumdb':77C,91C,111C 'version':115C,118C,124C 'via':92C 'within':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116313","severity":null,"published_at":"2026-11-12T15:17:39+00:00","modified_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}