CVE-2026-120153 PostgreSQL extension-script substitutions allow SQL injection through object names
A database user with CREATE privilege can inject SQL via object names to run code as the bootstrap superuser on PostgreSQL with vulnerable extension scripts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-120153?
CVE-2026-120153 is a high-severity SQL injection vulnerability in PostgreSQL, published on 12 Nov 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Weakness: CWE-89
Which versions are affected by CVE-2026-120153?
Only installations with a non-default setting turned on are exposed.
How do I fix CVE-2026-120153?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-120153 being exploited?
There is no known exploitation of CVE-2026-120153 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-120153, DEBIAN-CVE-2026-120153, ECHO-038e-d30b-d299, GHSA-w429-xmhm-p6jc.