PostgreSQL 18.x (< 18.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/postgresql-18.x--18.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 16:52:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPostgreSQL: SQL injection in pg_dump (CVE-2026-116318)https://feed.craftedsignal.io/briefs/2026-11-postgresql-sql-injection-cve-2026-116318/Thu, 12 Nov 2026 16:52:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-postgresql-sql-injection-cve-2026-116318/A SQL injection vulnerability in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring a dump.PostgreSQL pg_dump is affected by a SQL injection vulnerability (CVE-2026-116318) that allows an object creator to execute arbitrary SQL as the user restoring the dump. This occurs via an inherited column having a child-local not-null constraint whose name requires quoting. According to the source, within major version 18, minor versions before 18.7 are affected, while versions before PostgreSQL 18 are unaffected.

Impact

Successful exploitation allows an object creator to execute arbitrary SQL as the user restoring a dump file.

Recommendation

Administrators should monitor for patches and updates related to PostgreSQL version 18 and review environment security policies regarding database restoration.

]]>highadvisory