POSTGRESQL · CVE-2026-116330 · Runtime
NO FIX YET · SEE WHAT TO DO
A flaw in pg_dump's tar-format restore handling lets a compromised origin server include untrusted data in restore.sql, which psql then executes. An attacker who controls the origin database can run arbitrary code as the operating system account that runs psql.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that use pg_dump in tar format and restore the output with psql, especially when the dump comes from a server they do not fully control. The flaw is in the client tooling that runs restore.sql, so a server that only runs PostgreSQL and is never used as a restore client is not directly exposed. This is a gap in the earlier fix for CVE-2025-8714.
Not affected if custom-or-directory-format-dumps, no-tar-restores, trusted-origin-servers
Who cares pg_dump, postgresql, psql, self-hosted
psql --version and pg_dump --version on machines that restore tar-format dumps from other servers, and compare against the fixed versions below.psql from origin servers you do not fully control.18.717.12Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
16.1615.2014.25