CVE-2026-6475: PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
Last updated 22 May 2026
Other sources
PostgreSQL pgbasebackup and pgrewind can overwrite unrelated files of origin superuser choice
— Microsoft
Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like sharedpreloadlibraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6475?
CVE-2026-6475 is considered a critical vulnerability that can lead to serious file overwriting issues.
How do I fix CVE-2026-6475?
To fix CVE-2026-6475, ensure that you upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 or later.
Who is affected by CVE-2026-6475?
CVE-2026-6475 affects PostgreSQL users utilizing pg_basebackup and pg_rewind who have superuser privileges.
What are the potential consequences of CVE-2026-6475?
The potential consequences of CVE-2026-6475 include unauthorized file overwrites leading to alteration of crucial system files.
What methods can mitigate CVE-2026-6475?
Mitigation methods for CVE-2026-6475 include restricting superuser access and carefully managing symlink usage.