CVE-2026-116318 · Runtime
NO FIX YET · SEE WHAT TO DO
pg_dump, the PostgreSQL backup tool, builds SQL from an inherited column's not-null constraint name without proper quoting. A user who can create database objects can plant a name that runs arbitrary SQL as whoever restores the dump.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only PostgreSQL 18 releases before 18.7 are affected; earlier major versions are not. The risk sits in the restore step: someone who restores a dump made from a database containing attacker-created objects runs the injected SQL with their own privileges. Teams that only dump their own trusted databases and never restore dumps from others have lower exposure.
Not affected if no-untrusted-dump-restores, postgresql-17-or-earlier
Who cares database-backup, pg_dump, postgresql
psql -c "SELECT version();" or pg_dump --version and confirm the major version is 18.18.7.18.7 or later.SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.