Vulnerability Bulletins |
CVE-2026-116313 |
|
| Affected software | POSTGRESQL |
| Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-116313 | |