PostgreSQL: SQL injection in pg_dump (CVE-2026-116318)
A SQL injection vulnerability in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring a dump.
CVE search metadata
CVE search record: CVE-2026-116318. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL 18.x (< 18.7). Brief: PostgreSQL: SQL injection in pg_dump (CVE-2026-116318). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-sql-injection-cve-2026-116318/
Triage facts
Revision 1- Applicability
- PostgreSQL 18.x (< 18.7)
- Evidence
- Not observed
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
PostgreSQL pg_dump is affected by a SQL injection vulnerability (CVE-2026-116318) that allows an object creator to execute arbitrary SQL as the user restoring the dump. This occurs via an inherited column having a child-local not-null constraint whose name requires quoting. According to the source, within major version 18, minor versions before 18.7 are affected, while versions before PostgreSQL 18 are unaffected.
Impact
Successful exploitation allows an object creator to execute arbitrary SQL as the user restoring a dump file.
Recommendation
Administrators should monitor for patches and updates related to PostgreSQL version 18 and review environment security policies regarding database restoration.