PostgreSQL: Arbitrary SQL execution in vacuumdb (CVE-2026-116313)

PostgreSQL versions 18.0 through 18.6 contain an untrusted search path vulnerability in the vacuumdb utility (CVE-2026-116313). A malicious database owner can exploit this flaw by shadowing operators used in the --missing-stats-only catalog query. When a higher-privileged user or an automated process executes this specific vacuumdb command, the malicious operator is invoked, allowing the attacker to execute arbitrary SQL as the user running the utility. This issue arises from improper handling of the search path, which can be manipulated to redirect lookups.

Impact

Successful exploitation allows a low-privileged database owner to execute arbitrary SQL with the privileges of the user running the vacuumdb utility. This can lead to privilege escalation or unauthorized data access if the utility is executed by a superuser or a user with elevated system permissions.

Recommendation

Upgrade PostgreSQL to version 18.7 or later. Review all automated scripts or cron jobs that invoke vacuumdb, particularly those using the --missing-stats-only flag, to ensure they are not run with excessive privileges until the patch is applied.