Attack Chain

1. An attacker crafts a malicious channel name containing SQL injection payloads.
2. The application calls Postgrex.Notifications.listen/3 or Postgrex.Notifications.unlisten/3 with the malicious channel name.
3. Postgrex interpolates the unsanitized channel name into a LISTEN or UNLISTEN SQL command.
4. The injected SQL command is executed on the notifications connection.
5. The attacker can execute arbitrary SQL commands, such as creating tables, dropping tables, or creating roles.
6. This can lead to privilege escalation within the database.
7. Sensitive data can be accessed, modified, or deleted.
8. The attacker gains control over the application’s database.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2026-32687) can allow attackers to execute arbitrary SQL commands on the database, potentially leading to unauthorized data access, modification, or destruction. Since the notifications connection runs as the application’s database role, the attacker can read, modify, or destroy any data that the application’s DB role has access to. This could have a severe impact on the application’s functionality and data integrity.

Recommendation

• Upgrade to Postgrex version 0.22.2 or later to patch the vulnerability.
• Sanitize user input used as channel names in Postgrex.Notifications.listen/3 and Postgrex.Notifications.unlisten/3 by ensuring it does not contain quotes or null bytes, as recommended in the advisory.
• Deploy the Sigma rules provided below to detect potential exploitation attempts in your environment.