CVE-2026-6475

Description

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected packages (9)

• Alpine/postgresql15from 0, < 15.18-r0
• Alpine/postgresql16from 0, < 16.14-r0
• Alpine/postgresql17from 0, < 17.10-r0
• Alpine/postgresql18from 0, < 18.4-r0
• Bitnami/postgresqlfrom 0, < 14.23.0, >= 15.0.0, < 15.18.0, >= 16.0.0, < 16.14.0, >= 17.0.0, < 17.10.0, >= 18.0.0, < 18.4.0
• Debian/postgresql-13from 0
• Debian/postgresql-15from 0, < 15.18-0+deb12u1
• Debian/postgresql-17from 0, < 17.10-0+deb13u1
• Debian/postgresql-18from 0, < 18.4-1

CVSS scores

References (4)

• ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2026-6475
• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-6475
• WEBhttps://nvd.nist.gov/vuln/detail/CVE-2026-6475
• WEBhttps://www.postgresql.org/support/security/CVE-2026-6475/