SQL injection in PostgreSQL - CVE-2026-116325
Published: November 12, 2026
Vulnerability identifier: #VU166112
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116325
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL as the database user running reindexdb.
The vulnerability exists due to improper quoting of index names in the PostgreSQL reindexdb utility when constructing the parallel catalog query for --jobs with --index. A remote user can create an index with a crafted name and induce a database user to run reindexdb with these options to execute arbitrary SQL with that database user's privileges.
Affected software
PostgreSQL
How to mitigate CVE-2026-116325
Install security update from vendor's website.
PostgreSQL - addressed in versions 17.12, 18.7