Untrusted search path in PostgreSQL - CVE-2026-116313
Published: November 12, 2026
Vulnerability identifier: #VU166123
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116313
CWE-ID: CWE-426
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary SQL with the privileges of the database user running vacuumdb.
The vulnerability exists due to an untrusted search path in PostgreSQL vacuumdb when executing the --missing-stats-only catalog query. A remote privileged user can use database ownership privileges to shadow operators used by this query to execute arbitrary SQL as the database user running vacuumdb.
Affected software
PostgreSQL
How to mitigate CVE-2026-116313
Install security update from vendor's website.
PostgreSQL - update to 18.7