Executive brief
A vulnerability in the PostgreSQL database utility 'pg_createsubscriber' allows an authorized user to gain full administrative control over the database server. By manipulating subscription names, an attacker can execute unauthorized commands with the highest level of privilege (superuser). This could lead to the complete theft of data, modification of records, or disruption of database services.
Technical details
A SQL injection vulnerability exists in the PostgreSQL 'pg_createsubscriber' utility due to improper neutralization of subscription names. An attacker who possesses 'pg_create_subscription' privileges can craft a malicious subscription name that triggers the injection when the utility is subsequently executed. Successful exploitation allows the attacker to execute arbitrary SQL commands with superuser privileges on the database server. The vulnerability affects major versions 17 and 18; it has been addressed in versions 17.10 and 18.4. Versions prior to 17 are not affected.
Affected products
- PostgreSQL PostgreSQL 17.x before 17.10, 18.x before 18.4
Timeline
- 2026-05-14: disclosed
- 2026-05-14: patched
- 2026-05-14: advisory