CVE-2026-6475

CVE Details

Release Date:	2026-05-14
Impact:	Moderate	What is this?

Description

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

See more information about CVE-2026-6475 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	6.7
Vector String:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (libpq)	ELSA-2026-27738	2026-06-22
Oracle Linux version 9 (pg_repack)	ELSA-2026-28037	2026-06-24
Oracle Linux version 9 (pgaudit)	ELSA-2026-28037	2026-06-24
Oracle Linux version 9 (postgres-decoderbufs)	ELSA-2026-28037	2026-06-24
Oracle Linux version 9 (postgresql)	ELSA-2026-28037	2026-06-24