CVE-2026-6638: PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
Last updated 22 May 2026
Other sources
PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
— Microsoft
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6638?
CVE-2026-6638 is considered a high severity vulnerability due to the potential for SQL injection leading to arbitrary SQL execution with publication-side credentials.
How do I fix CVE-2026-6638?
To mitigate CVE-2026-6638, upgrade PostgreSQL to version 16.14 or later, 17.10 or later, or 18.4 or later.
What is the impact of CVE-2026-6638?
CVE-2026-6638 allows an attacker to exploit SQL injection vulnerabilities in REFRESH PUBLICATION to execute arbitrary SQL on the subscribed database.
Who is affected by CVE-2026-6638?
CVE-2026-6638 affects PostgreSQL versions prior to 16.14, 17.10, and 18.4, particularly those using logical replication.
Can I test my system for CVE-2026-6638 vulnerabilities?
You can test your system by reviewing permissions and configurations related to PostgreSQL logical replication and validating against the vulnerability vector.