PostgreSQL: pg_dump arbitrary code execution (CVE-2026-116330)
PostgreSQL is vulnerable to arbitrary code execution via untrusted data in pg_dump tar-format restore.sql files, for which an exploit has been published.
CVE search metadata
CVE search record: CVE-2026-116330. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: pg_dump arbitrary code execution (CVE-2026-116330). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-rce-cve-2026-116330/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Not observed
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 12, 16:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
PostgreSQL is vulnerable to arbitrary code execution when processing untrusted data in pg_dump tar-format restore.sql files. A compromised origin server can exploit this to execute arbitrary code as the client operating system account running psql.
Impact
Successful exploitation allows for arbitrary code execution with the privileges of the system user running the psql client.
Recommendation
Refer to the official PostgreSQL security advisory for guidance on remediation and version updates.
Threat Hunt
Identify execution of psql sessions involving the processing of pg_dump tar-format files or specifically searching for spawned child processes originating from the psql utility that interact with restore.sql or unexpected external commands.
Data: Process creation logs, Command-line arguments for psql, Parent-child process relationships