{"id":"CVE-2026-116325","kind":"vulnerability","aliases":["CVE-2026-116325"],"related":[],"title":"PostgreSQL: reindexdb index name lets an object creator run SQL","description":"SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected.","summary":"PostgreSQL's reindexdb tool builds a catalog query from index names, so a crafted index name can inject SQL. An attacker who can create database objects can run arbitrary SQL as the user running reindexdb.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-admin","postgresql","runtime","self-hosted"],"not_affected_if":["no-reindexdb-jobs-index","postgresql-below-17"],"how_to_check":"- Check the server version with `psql -c \"SHOW server_version;\"` and the reindexdb client with `reindexdb --version`\n- Look for scheduled or manual uses of `reindexdb --jobs` combined with `--index` in cron jobs or maintenance scripts","fix":"- PostgreSQL 18: move to `18.7` or later\n- PostgreSQL 17: move to `17.12` or later\n- Versions before 17 are not affected, per the source","status":"open","published_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:44+00:00","updated_at":"2026-11-12T15:43:44+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:44Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: move to `18.7` or later\n- PostgreSQL 17: move to `17.12` or later\n- Versions before 17 are not affected, per the source","reach":"local","title":"PostgreSQL: reindexdb index name lets an object creator run SQL","impact":"high","summary":"PostgreSQL's reindexdb tool builds a catalog query from index names, so a crafted index name can inject SQL. An attacker who can create database objects can run arbitrary SQL as the user running reindexdb.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database-admin"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"SQL runs as the reindexdb user, possibly a superuser","analyst_note":"","how_to_check":"- Check the server version with `psql -c \"SHOW server_version;\"` and the reindexdb client with `reindexdb --version`\n- Look for scheduled or manual uses of `reindexdb --jobs` combined with `--index` in cron jobs or maintenance scripts","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["postgresql-below-17","no-reindexdb-jobs-index"],"who_is_affected":"Teams running PostgreSQL 17 or 18 that use reindexdb with --jobs and --index, typically in maintenance jobs run by an admin account. An attacker must be able to create objects in the database, and the injected SQL runs with the privileges of whoever runs reindexdb. Installations on PostgreSQL 16 and earlier are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4589,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116325':13A,16A '-18':98C '-2026':12A,15A '17':97C,111C '17.12':105C '18.7':103C 'admin':19B 'affect':107C 'allow':65C 'arbitrari':53B,71C 'attack':45B 'build':29B 'catalog':31B,88C 'craft':38B,81C 'creat':48B 'creator':8A,68C 'cve':11A,14A 'databas':18B,49B,75C 'database-admin':17B 'embed':84C 'execut':70C 'host':24B 'index':3A,34B,39B,82C,93C 'inject':42B,61C 'job':91C 'let':5A 'major':95C 'minor':99C 'name':4A,35B,40B,83C 'object':7A,50B,67C 'parallel':87C 'postgresql':1A,20B,25B,63C,102C,110C 'queri':32B,89C 'reindexdb':2A,27B,59B,64C,78C 'run':9A,52B,58B,77C 'runtim':21B 'self':23B 'self-host':22B 'sql':10A,43B,54B,60C,72C 'tool':28B 'unaffect':113C 'user':57B,76C 'version':96C,100C,108C 'via':79C 'within':94C","nicknames":[],"mitigations":[],"who_affected":"Teams running PostgreSQL 17 or 18 that use reindexdb with --jobs and --index, typically in maintenance jobs run by an admin account. An attacker must be able to create objects in the database, and the injected SQL runs with the privileges of whoever runs reindexdb. Installations on PostgreSQL 16 and earlier are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databaseadmin","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116325':13A,16A '-2026':12A,15A 'creator':8A 'cve':11A,14A 'index':3A 'let':5A 'name':4A 'object':7A 'postgresql':1A 'reindexdb':2A 'run':9A 'sql':10A","search_b":"'admin':19B 'arbitrari':53B 'attack':45B 'build':29B 'catalog':31B 'craft':38B 'creat':48B 'databas':18B,49B 'database-admin':17B 'host':24B 'index':34B,39B 'inject':42B 'name':35B,40B 'object':50B 'postgresql':20B,25B 'queri':32B 'reindexdb':27B,59B 'run':52B,58B 'runtim':21B 'self':23B 'self-host':22B 'sql':43B,54B 'tool':28B 'user':57B","search_c":"'-18':98C '17':97C,111C '17.12':105C '18.7':103C 'affect':107C 'allow':65C 'arbitrari':71C 'catalog':88C 'craft':81C 'creator':68C 'databas':75C 'embed':84C 'execut':70C 'index':82C,93C 'inject':61C 'job':91C 'major':95C 'minor':99C 'name':83C 'object':67C 'parallel':87C 'postgresql':63C,102C,110C 'queri':89C 'reindexdb':64C,78C 'run':77C 'sql':60C,72C 'unaffect':113C 'user':76C 'version':96C,100C,108C 'via':79C 'within':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116325","severity":null,"published_at":"2026-11-12T15:17:40+00:00","modified_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}