{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/postgresql-18.0--version--18.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:18.0:*:*:*:*:*:*:*","cpe:2.3:a:postgresql:postgresql:18.6:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-116313"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (18.0 \u003c= version \u003c 18.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003ePostgreSQL versions 18.0 through 18.6 contain an untrusted search path vulnerability in the vacuumdb utility (CVE-2026-116313). A malicious database owner can exploit this flaw by shadowing operators used in the --missing-stats-only catalog query. When a higher-privileged user or an automated process executes this specific vacuumdb command, the malicious operator is invoked, allowing the attacker to execute arbitrary SQL as the user running the utility. This issue arises from improper handling of the search path, which can be manipulated to redirect lookups.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged database owner to execute arbitrary SQL with the privileges of the user running the vacuumdb utility. This can lead to privilege escalation or unauthorized data access if the utility is executed by a superuser or a user with elevated system permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade PostgreSQL to version 18.7 or later. Review all automated scripts or cron jobs that invoke vacuumdb, particularly those using the --missing-stats-only flag, to ensure they are not run with excessive privileges until the patch is applied.\u003c/p\u003e\n","date_modified":"2026-11-12T16:52:02Z","date_published":"2026-11-12T16:52:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-vacuumdb-rce-cve-2026-116313/","summary":"An untrusted search path vulnerability in the PostgreSQL vacuumdb utility allows a malicious database owner to execute arbitrary SQL commands via operator shadowing during --missing-stats-only operations.","title":"PostgreSQL: Arbitrary SQL execution in vacuumdb (CVE-2026-116313)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-vacuumdb-rce-cve-2026-116313/"}],"language":"en","title":"CraftedSignal Threat Feed - PostgreSQL (18.0 \u003c= Version \u003c 18.7)","version":"https://jsonfeed.org/version/1.1"}