CVE-2026-116313

HighCVSS 7.2/10Last modified Nov 13, 2026

Description

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 12, 2026
Last modified
Nov 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1163148.8Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system useCVE-2026-1163158.8Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user runCVE-2026-1163168.8Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the CVE-2026-1163178.8Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user runniCVE-2026-1163188.8SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited columCVE-2026-1163198.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, viCVE-2026-116327.5Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI CVE-2026-1163208.8Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, viCVE-2026-1163214.3Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byCVE-2026-1163225.3Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for auCVE-2026-1163238.8Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, viaCVE-2026-1163258.0SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafte
CVE-2026-116313: High severity, CVSS 7.2 | Vulnix