{"id":"CVE-2026-116318","kind":"vulnerability","aliases":["CVE-2026-116318"],"related":[],"title":"PostgreSQL pg_dump: crafted object names let an attacker run SQL on restore","description":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected.","summary":"pg_dump, the PostgreSQL backup tool, builds SQL from an inherited column's not-null constraint name without proper quoting. A user who can create database objects can plant a name that runs arbitrary SQL as whoever restores the dump.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-backup","pg_dump","postgresql","runtime"],"not_affected_if":["no-untrusted-dump-restores","postgresql-17-or-earlier"],"how_to_check":"- Run `psql -c \"SELECT version();\"` or `pg_dump --version` and confirm the major version is `18`.\n- Check the minor version is below `18.7`.","fix":"- PostgreSQL 18: move to `18.7` or later.","status":"open","published_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:33+00:00","updated_at":"2026-11-12T15:43:33+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:33Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: move to `18.7` or later.","reach":"local","title":"PostgreSQL pg_dump: crafted object names let an attacker run SQL on restore","impact":"high","summary":"pg_dump, the PostgreSQL backup tool, builds SQL from an inherited column's not-null constraint name without proper quoting. A user who can create database objects can plant a name that runs arbitrary SQL as whoever restores the dump.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","pg_dump","database-backup"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"SQL runs as the restoring user during a database restore","analyst_note":"","how_to_check":"- Run `psql -c \"SELECT version();\"` or `pg_dump --version` and confirm the major version is `18`.\n- Check the minor version is below `18.7`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["postgresql-17-or-earlier","no-untrusted-dump-restores"],"who_is_affected":"Only PostgreSQL 18 releases before 18.7 are affected; earlier major versions are not. The risk sits in the restore step: someone who restores a dump made from a database containing attacker-created objects runs the injected SQL with their own privileges. Teams that only dump their own trusted databases and never restore dumps from others have lower exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4579,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116318':16A,19A '-2026':15A,18A '18':108C,119C '18.7':113C 'affect':115C 'allow':74C 'arbitrari':61B,80C 'attack':9A 'backup':22B,31B 'build':33B 'child':95C 'child-loc':94C 'column':38B,91C 'constraint':43B,100C 'craft':4A 'creat':52B 'creator':77C 'cve':14A,17A 'databas':21B,53B 'database-backup':20B 'dump':3A,24B,28B,67B,73C,87C 'execut':79C 'inherit':37B,90C 'inject':69C 'let':7A 'local':96C 'major':106C 'minor':109C 'name':6A,44B,58B,102C 'not-nul':40B,97C 'null':42B,99C 'object':5A,54B,76C 'pg':2A,23B,27B,72C 'plant':56B 'postgresql':1A,25B,30B,71C,112C,118C 'proper':46B 'quot':47B,104C 'requir':103C 'restor':13A,65B,85C 'run':10A,60B 'runtim':26B 'sql':11A,34B,62B,68C,81C 'tool':32B 'unaffect':121C 'user':49B,84C 'version':107C,110C,116C 'via':88C 'whoever':64B 'whose':101C 'within':105C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Only PostgreSQL 18 releases before 18.7 are affected; earlier major versions are not. The risk sits in the restore step: someone who restores a dump made from a database containing attacker-created objects runs the injected SQL with their own privileges. Teams that only dump their own trusted databases and never restore dumps from others have lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databasebackup","high","pgdump","postgresql","runtime"],"campaign_type":null,"search_a":"'-116318':16A,19A '-2026':15A,18A 'attack':9A 'craft':4A 'cve':14A,17A 'dump':3A 'let':7A 'name':6A 'object':5A 'pg':2A 'postgresql':1A 'restor':13A 'run':10A 'sql':11A","search_b":"'arbitrari':61B 'backup':22B,31B 'build':33B 'column':38B 'constraint':43B 'creat':52B 'databas':21B,53B 'database-backup':20B 'dump':24B,28B,67B 'inherit':37B 'name':44B,58B 'not-nul':40B 'null':42B 'object':54B 'pg':23B,27B 'plant':56B 'postgresql':25B,30B 'proper':46B 'quot':47B 'restor':65B 'run':60B 'runtim':26B 'sql':34B,62B 'tool':32B 'user':49B 'whoever':64B 'without':45B","search_c":"'18':108C,119C '18.7':113C 'affect':115C 'allow':74C 'arbitrari':80C 'child':95C 'child-loc':94C 'column':91C 'constraint':100C 'creator':77C 'dump':73C,87C 'execut':79C 'inherit':90C 'inject':69C 'local':96C 'major':106C 'minor':109C 'name':102C 'not-nul':97C 'null':99C 'object':76C 'pg':72C 'postgresql':71C,112C,118C 'quot':104C 'requir':103C 'restor':85C 'sql':68C,81C 'unaffect':121C 'user':84C 'version':107C,110C,116C 'via':88C 'whose':101C 'within':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116318","severity":null,"published_at":"2026-11-12T15:17:40+00:00","modified_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}