{"id":"CVE-2026-116314","kind":"vulnerability","aliases":["CVE-2026-116314"],"related":[],"title":"PostgreSQL: crafted pg_restore archive runs code as the restoring user","description":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive.  Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A crafted archive passed to pg_restore can execute arbitrary operating system code as the user running pg_restore. An attacker who supplies the archive gets code execution on the machine running the restore.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admin","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","trusted-archives-only"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` or `pg_restore --version` to find the installed version\n- Check whether any version is below `18.7`, `17.12`, `16.16`, `15.20` or `14.25`","fix":"- Upgrade PostgreSQL to `18.7`, `17.12`, `16.16`, `15.20` or `14.25` (the fixed release for each major line)","status":"open","published_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:37+00:00","updated_at":"2026-11-12T15:43:37+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:43:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL to `18.7`, `17.12`, `16.16`, `15.20` or `14.25` (the fixed release for each major line)","reach":"local","title":"PostgreSQL: crafted pg_restore archive runs code as the restoring user","impact":"high","summary":"A crafted archive passed to pg_restore can execute arbitrary operating system code as the user running pg_restore. An attacker who supplies the archive gets code execution on the machine running the restore.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database-admin"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code as the pg_restore operating system user.","analyst_note":"","how_to_check":"- Run `psql -c \"SHOW server_version;\"` or `pg_restore --version` to find the installed version\n- Check whether any version is below `18.7`, `17.12`, `16.16`, `15.20` or `14.25`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","trusted-archives-only"],"who_is_affected":"Teams that run pg_restore on archives from sources they do not fully trust, such as backups or dumps received from outside the organisation, are exposed. Systems that only restore archives they created themselves, or that never run pg_restore on untrusted input, are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4626,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116314':14A,17A '-2026':13A,16A '14.25':130C '15.20':128C '16.16':127C '17.12':126C '18.7':125C 'admin':20B 'affect':132C 'allow':67C 'arbitrari':35B,76C,99C,113C 'archiv':5A,28B,50B,72C,89C,94C 'attack':46B 'caus':98C 'code':7A,38B,52B,77C,114C 'confer':112C 'contrast':92C 'craft':2A,27B,88C,93C 'cve':12A,15A 'data':95C 'databas':19B 'database-admin':18B 'destin':106C 'execut':34B,53B,75C,102C,115C 'get':51B 'host':25B 'improp':60C 'input':61C 'legitim':97C,111C 'machin':56B 'may':96C 'non':70C 'non-plain':69C 'note':90C 'oper':36B,80C 'os':120C 'pass':29B 'pg':3A,31B,43B,65C,84C,118C 'plain':71C 'postgresql':1A,21B,64C,124C 'process':121C 'provid':73C 'restor':4A,10A,32B,44B,59B,66C,85C,105C,119C 'run':6A,42B,57B,83C 'runtim':22B 'self':24B 'self-host':23B 'sql':100C 'suppli':48B 'system':37B,81C 'user':11A,41B,82C 'valid':62C 'version':122C 'via':86C","nicknames":[],"mitigations":[],"who_affected":"Teams that run pg_restore on archives from sources they do not fully trust, such as backups or dumps received from outside the organisation, are exposed. Systems that only restore archives they created themselves, or that never run pg_restore on untrusted input, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databaseadmin","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116314':14A,17A '-2026':13A,16A 'archiv':5A 'code':7A 'craft':2A 'cve':12A,15A 'pg':3A 'postgresql':1A 'restor':4A,10A 'run':6A 'user':11A","search_b":"'admin':20B 'arbitrari':35B 'archiv':28B,50B 'attack':46B 'code':38B,52B 'craft':27B 'databas':19B 'database-admin':18B 'execut':34B,53B 'get':51B 'host':25B 'machin':56B 'oper':36B 'pass':29B 'pg':31B,43B 'postgresql':21B 'restor':32B,44B,59B 'run':42B,57B 'runtim':22B 'self':24B 'self-host':23B 'suppli':48B 'system':37B 'user':41B","search_c":"'14.25':130C '15.20':128C '16.16':127C '17.12':126C '18.7':125C 'affect':132C 'allow':67C 'arbitrari':76C,99C,113C 'archiv':72C,89C,94C 'caus':98C 'code':77C,114C 'confer':112C 'contrast':92C 'craft':88C,93C 'data':95C 'destin':106C 'execut':75C,102C,115C 'improp':60C 'input':61C 'legitim':97C,111C 'may':96C 'non':70C 'non-plain':69C 'note':90C 'oper':80C 'os':120C 'pg':65C,84C,118C 'plain':71C 'postgresql':64C,124C 'process':121C 'provid':73C 'restor':66C,85C,105C,119C 'run':83C 'sql':100C 'system':81C 'user':82C 'valid':62C 'version':122C 'via':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116314","severity":null,"published_at":"2026-11-12T15:17:39+00:00","modified_at":"2026-11-12T15:17:39+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}