PostgreSQL: SQL injection in reindexdb (CVE-2026-116325)
A SQL injection vulnerability in the PostgreSQL reindexdb utility allows an object creator to execute arbitrary SQL as the database user running the tool via a crafted index name.
CVE search metadata
CVE search record: CVE-2026-116325. Severity: high. CVSS: 8.0. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: SQL injection in reindexdb (CVE-2026-116325). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-reindexdb-sql-injection-cve-2026-116325/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
PostgreSQL is affected by a SQL injection vulnerability (CVE-2026-116325) within the reindexdb utility. An object creator can execute arbitrary SQL as the database user running reindexdb by using a crafted index name when the utility is invoked with the --jobs and --index flags.
Impact
Successful exploitation allows an object creator to execute arbitrary SQL commands with the privileges of the database user running reindexdb.
Recommendation
Administrators should review the official PostgreSQL security advisories to determine if their specific versions are affected and require patching.