Executive brief
A security vulnerability exists in PostgreSQL's data synchronization feature (logical replication). An attacker with the ability to create tables on a receiving database can inject malicious commands that execute with the privileges of the sending database's credentials. This could lead to unauthorized data access or modification on the primary database server during the next synchronization update.
Technical details
A SQL injection vulnerability exists in the 'ALTER SUBSCRIPTION ... REFRESH PUBLICATION' command within PostgreSQL's logical replication core server component. The flaw allows a user who can create tables on the subscriber side to craft table names or metadata that trigger arbitrary SQL execution on the publisher side using the subscription's connection credentials. The exploit is delayed, taking effect only when a REFRESH PUBLICATION operation is subsequently performed. This affects major versions 16, 17, and 18; versions prior to 16 are not impacted. Patches are available in versions 16.14, 17.10, and 18.4.
Affected products
- PostgreSQL PostgreSQL 16.x before 16.14, 17.x before 17.10, 18.x before 18.4
Timeline
- 2026-05-12: patched: Fixes released in versions 18.4, 17.10, and 16.14.
- 2026-05-14: disclosed: Public disclosure of CVE-2026-6638.