sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-18408 PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

High 8.8 Published Updated

A malicious superuser on the origin server can execute arbitrary code on the client machine running psql during a database restore operation.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
A user has to click or open something
Fix
Available

What is CVE-2026-18408?

CVE-2026-18408 is a high-severity code injection vulnerability in Postgresql Postgresql, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Weakness: CWE-829

Which versions are affected by CVE-2026-18408?

1 open source package ship an affected version, including postgresql. It affects 1 product.

PackageAffectedFixed in
postgresql BitnamiAll versions14.24.0, 15.19.0, 16.15.0, 17.11.0, 18.5.0
Linux distribution packages (39)
pgaudit Red Hat:rhel_aus:8.4::appstreamAll versions0:1.4.0-6.module+el8.4.0+11288+c193d6d7
pgaudit-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:1.4.0-6.module+el8.4.0+11288+c193d6d7
pgaudit-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:1.4.0-6.module+el8.4.0+11288+c193d6d7
postgres-decoderbufs Red Hat:rhel_aus:8.4::appstreamAll versions0:0.10.0-2.module+el8.4.0+11288+c193d6d7
postgres-decoderbufs-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:0.10.0-2.module+el8.4.0+11288+c193d6d7
postgres-decoderbufs-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:0.10.0-2.module+el8.4.0+11288+c193d6d7
postgresql Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-contrib Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-contrib-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-debugsource Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-docs Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-docs-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plperl Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plperl-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plpython3 Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-plpython3-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-pltcl Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-pltcl-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server-devel Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-server-devel-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-static Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-test Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-test-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-test-rpm-macros Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade-devel Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
postgresql-upgrade-devel-debuginfo Red Hat:rhel_aus:8.4::appstreamAll versions0:12.22-1.module+el8.4.0+24985+ffa880ed.7
pg_repack Red Hat:rhel_aus:8.6::appstreamAll versions0:1.4.6-3.module+el8.5.0+11354+78b3c9c5
pg_repack-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:1.4.6-3.module+el8.5.0+11354+78b3c9c5
pg_repack-debugsource Red Hat:rhel_aus:8.6::appstreamAll versions0:1.4.6-3.module+el8.5.0+11354+78b3c9c5
pgaudit Red Hat:rhel_aus:8.6::appstreamAll versions0:1.4.0-5.module+el8.5.0+11354+78b3c9c5
pgaudit-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:1.4.0-5.module+el8.5.0+11354+78b3c9c5
pgaudit-debugsource Red Hat:rhel_aus:8.6::appstreamAll versions0:1.4.0-5.module+el8.5.0+11354+78b3c9c5
postgres-decoderbufs Red Hat:rhel_aus:8.6::appstreamAll versions0:0.10.0-2.module+el8.5.0+11354+78b3c9c5
postgres-decoderbufs-debuginfo Red Hat:rhel_aus:8.6::appstreamAll versions0:0.10.0-2.module+el8.5.0+11354+78b3c9c5

Products include Postgresql Postgresql.

How do I fix CVE-2026-18408?

Upgrade postgresql to a fixed version for your release line: 14.24.0, 15.19.0, 16.15.0 or 17.11.0.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-18408 being exploited?

There is no known exploitation of CVE-2026-18408 in the wild and no public exploit code.

All Postgresql Postgresql vulnerabilities

Sources

Also known as ALPINE-CVE-2026-18408, AZL-95705, BELL-CVE-2026-18408, BIT-postgresql-2026-18408, DEBIAN-CVE-2026-18408, ECHO-81a7-2888-c43b and 12 more.

Is CVE-2026-18408 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free