CVE-2026-116325 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's reindexdb tool builds a catalog query from index names, so a crafted index name can inject SQL. An attacker who can create database objects can run arbitrary SQL as the user running reindexdb.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running PostgreSQL 17 or 18 that use reindexdb with --jobs and --index, typically in maintenance jobs run by an admin account. An attacker must be able to create objects in the database, and the injected SQL runs with the privileges of whoever runs reindexdb. Installations on PostgreSQL 16 and earlier are not affected.
Not affected if no-reindexdb-jobs-index, postgresql-below-17
Who cares database-admin, postgresql, self-hosted
psql -c "SHOW server_version;" and the reindexdb client with reindexdb --versionreindexdb --jobs combined with --index in cron jobs or maintenance scripts18.7 or later17.12 or laterSQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.