# CVE-2026-14661: PostgreSQL dblink and subscriptions arbitrary file append

Source: https://junglewise.ai/threats/cve-2026-14661-external-control-of-file-name-in-postgresql-dblink-and-create  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-14661 · Severity: high · CVSS 8.1 · Published 2026-11-12

PostgreSQL's dblink extension and subscription features allow authenticated users to append data to arbitrary files on the system through the sslkeylogfile connection parameter. An attacker with database access can cause persistent denial of service by corrupting critical files or filling disk space, or potentially compromise application configuration files.

Technologies: [PostgreSQL](https://junglewise.ai/threats/technologies/postgresql). Vendors: [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql).

## Quick answers

**Is CVE-2026-14661 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14661 being exploited in the wild.

**How severe is CVE-2026-14661?** High severity, with a CVSS score of 8.1, published 12 November 2026.

**Which products and versions are affected?** PostgreSQL Libpq 18.0 and later when used with PostgreSQL versions prior to 18; PostgreSQL 14.0 to 14.24, 15.0 to 15.19, 16.0 to 16.15, 17.0 to 17.11, 18.0 to 18.6.

**Is there a fix for CVE-2026-14661?** Yes: fixed in PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14661 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-14661?** Check whether you run PostgreSQL Libpq or PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7

## Technical details

A path traversal vulnerability in the sslkeylogfile parameter of PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows authenticated database users to write NSS keylog format data to files of their choosing. The vulnerability requires database login privileges but no special configuration; affected versions include PostgreSQL 18.0–18.6, 17.0–17.11, 16.0–16.15, 15.0–15.19, 14.0–14.24, and older versions if libpq 18+ is in use. The attack succeeds locally or remotely if network access to the database is available.

## Affected products

- PostgreSQL PostgreSQL 14.0 to 14.24, 15.0 to 15.19, 16.0 to 16.15, 17.0 to 17.11, 18.0 to 18.6
- PostgreSQL libpq 18.0 and later when used with PostgreSQL versions prior to 18

## Timeline

- 2026-11-12: disclosed

## References

- [https://www.postgresql.org/support/security/CVE-2026-14661/](https://www.postgresql.org/support/security/CVE-2026-14661/)

## Related threats

- [PostgreSQL CREATE EXTENSION arbitrary SQL execution](https://junglewise.ai/threats/cve-2026-6467-uncontrolled-search-path-element-in-postgresql-create-extension)
- [PostgreSQL type confusion in ALTER allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-6460-type-confusion-in-postgresql-allows-an-object-creator-to-execute)
- [PostgreSQL type confusion in SQL-language functions arbitrary code execution](https://junglewise.ai/threats/cve-2026-18447-type-confusion-in-postgresql-sql-language-functions-allows-an)
- [PostgreSQL INSERT ON CONFLICT authorization bypass on auto-updatable views](https://junglewise.ai/threats/cve-2026-16237-improper-protection-in-postgresql-insert-on-conflict-on-auto)
- [PostgreSQL INSERT ... ON CONFLICT row security bypass](https://junglewise.ai/threats/cve-2026-120154-improper-protection-in-postgresql-insert-on-conflict-allows-an)