CVE-2026-6476: PostgreSQL pg_createsubscriber allows SQL injection via subscription name
Last updated 22 May 2026
Other sources
SQL injection in PostgreSQL pgcreatesubscriber allows an attacker with pgcreatesubscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pgcreatesubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6476?
CVE-2026-6476 is considered a critical vulnerability due to the potential for SQL injection that allows arbitrary SQL execution as a superuser.
How do I fix CVE-2026-6476?
To fix CVE-2026-6476, update your PostgreSQL installation to a version beyond 17.10 or 18.4 as soon as possible.
What versions of PostgreSQL are affected by CVE-2026-6476?
CVE-2026-6476 affects PostgreSQL versions from 17.0 up to 17.10 and from 18.0 up to 18.4.
Who can exploit CVE-2026-6476?
An attacker with pg_create_subscription rights can exploit CVE-2026-6476 to execute arbitrary SQL.
What are the consequences of CVE-2026-6476 exploitation?
Exploitation of CVE-2026-6476 can lead to unauthorized superuser access and potential compromise of the PostgreSQL database system.