PostgreSQL: pg_restore arbitrary code execution (CVE-2026-116314)
Improper input validation in PostgreSQL pg_restore allows an attacker to execute arbitrary code as the operating system user by providing a crafted non-plain archive file.
CVE search metadata
CVE search record: CVE-2026-116314. KEV: no. Product: PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25). Brief: PostgreSQL: pg_restore arbitrary code execution (CVE-2026-116314). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-116314/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 12, 16:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
PostgreSQL has identified a vulnerability in the pg_restore utility (CVE-2026-116314) where improper input validation in the processing of non-plain archives allows for arbitrary code execution. The vulnerability exists when pg_restore processes a maliciously crafted archive file. While pg_restore is intended to execute SQL, the vulnerability permits the execution of arbitrary code within the OS process running the tool. Affected versions are PostgreSQL 14.x before 14.25, 15.x before 15.20, 16.x before 16.16, 17.x before 17.12, and 18.x before 18.7.
Impact
Successful exploitation allows an attacker to gain code execution as the operating system user account under which the pg_restore utility is executed. This can lead to full system compromise depending on the privileges of that user.
Recommendation
- Upgrade PostgreSQL to the patched versions: 18.7, 17.12, 16.16, 15.20, or 14.25.
- Review all automated database restore procedures and ensure that archive files processed by pg_restore originate from trusted sources only.
Immediate actions
Upgrade all PostgreSQL installations to the patched versions (18.7, 17.12, 16.16, 15.20, or 14.25)
Threat Hunt
Identify execution of pg_restore utility within the environment to determine exposure
Data: Process execution logs (e.g., Sysmon Event ID 1, Linux auditd)
Mitigations
Update PostgreSQL to fixed releases
CVE-2026-116314