Skip to content
OpenAdvisories

Description

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

VendorProductAffectedFixed
— PostgreSQL 18 – < 18.4, 17 – < 17.10, 16 – < 16.14, 15 – < 15.18, < 14.23 18.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 postgresql-18 18.4-1 —
Debian 13 postgresql-17 17.10-0+deb13u1 —
Debian 12 postgresql-15 15.18-0+deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS postgresql-18 18.4-0ubuntu0.26.04.1 —
Ubuntu 25.10 postgresql-17 17.10-0ubuntu0.25.10.1 —
Ubuntu 24.04 LTS postgresql-16 16.14-0ubuntu0.24.04.1 —
Ubuntu 22.04 LTS postgresql-14 14.23-0ubuntu0.22.04.1 —
Ubuntu 20.04 LTS postgresql-12 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS postgresql-10 No fix yet —
Ubuntu Pro 16.04 LTS postgresql-9.5 No fix yet —
Ubuntu Pro 14.04 LTS postgresql-9.3 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 postgresql +15 16.14-1.el10_2 RHSA-2026:27743
RHEL 10 postgresql18 +13 18.4-1.el10_2 RHSA-2026:27742
RHEL 9 pg_repack 1.4.8-2.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 pgaudit 1.7.0-1.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 pgvector 0.6.2-2.module+el9.8.0+24090+8f0ee565 RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgis +4 3.5.3-5.module+el9.8.0+24090+8f0ee565 RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgresql +14 13.23-3.el9_8 RHSA-2026:28037, RHSA-2026:27741, RHSA-2026:26204
RHEL 8 libpq +1 13.23-2.el8_10 RHSA-2026:27738
RHEL 8 pg_repack 1.4.6-3.module+el8.9.0+19330+c97ddbdf RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 pgaudit 1.4.0-7.module+el8.10.0+22214+9beb89d6 RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgres-decoderbufs 0.10.0-2.module+el8.9.0+19330+c97ddbdf RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgresql +12 12.22-7.module+el8.10.0+24362+fcf88eed RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgresql-private-libs +1 15.18-1.module+el8.10.0+24361+29e043a0 RHSA-2026:28143, RHSA-2026:26181
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS postgresql +15 16.14-1.el10_0 RHSA-2026:27718
RHEL 9.6 EUS pg_repack 1.4.8-2.module+el9.5.0+22224+f5585c78 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS pgvector 0.6.2-2.module+el9.6.0+22979+c3d78d52 RHSA-2026:26525
RHEL 9.6 EUS postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS postgresql +14 13.23-1.el9_6.2 RHSA-2026:32983, RHSA-2026:29212, RHSA-2026:26525
RHEL 9.4 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S postgresql +7 13.23-1.el9_4.2 RHSA-2026:33441, RHSA-2026:29904, RHSA-2026:26524
RHEL 9.4 E4S postgresql-docs +6 15.18-1.module+el9.4.0+24401+d70df5dc RHSA-2026:33441, RHSA-2026:26524
RHEL 9.2 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S postgresql +7 13.23-1.el9_2.2 RHSA-2026:33497, RHSA-2026:29953
RHEL 9.2 E4S postgresql-docs +6 15.18-1.module+el9.2.0+24451+e803ec54 RHSA-2026:33497
RHEL 8.8 TUS libpq +1 13.23-1.el8_8.1 RHSA-2026:35880
RHEL 8.8 TUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgresql +12 12.22-1.module+el8.8.0+24458+21f81c54.4 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgresql-private-libs +1 15.18-1.module+el8.8.0+24395+e7b9b4b6 RHSA-2026:26561
RHEL 8.8 E4S libpq +1 13.23-1.el8_8.1 RHSA-2026:35880
RHEL 8.8 E4S pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgresql +12 12.22-1.module+el8.8.0+24458+21f81c54.4 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgresql-private-libs +1 15.18-1.module+el8.8.0+24395+e7b9b4b6 RHSA-2026:26561
RHEL 8.6 EUS Long Life pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life postgresql +12 12.22-1.module+el8.6.0+24433+21669af6.4 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS postgresql +12 12.22-1.module+el8.6.0+24433+21669af6.4 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.4 EUS Long Life libpq +1 13.23-1.el8_4.1 RHSA-2026:44420
RHEL 8.4 EUS Long Life pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 EUS Long Life postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 EUS Long Life postgresql +12 12.22-1.module+el8.4.0+24442+74e4dc28.4 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS libpq +1 13.23-1.el8_4.1 RHSA-2026:44420
RHEL 8.4 AUS pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS postgresql +12 12.22-1.module+el8.4.0+24442+74e4dc28.4 RHSA-2026:34363, RHSA-2026:34362
Red Hat Hardened Images 1 postgresql +14 18.4-0.1.hum1 RHSA-2026:22878
Red Hat Hardened Images 1 postgresql17 +14 17.10-0.1.hum1 RHSA-2026:21182

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 postgresql +14 16.14-1.el10_2 ALSA-2026:27743
AlmaLinux 10 postgresql18 +13 18.4-1.el10_2 ALSA-2026:27742
AlmaLinux 9 pg_repack 1.4.8-2.module_el9.5.0+119+18833d03 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 pgaudit 1.7.0-1.module_el9.3.0+52+21733919 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 pgvector 0.6.2-2.module_el9.6.0+167+4e561146 ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgis +4 3.5.3-5.module_el9.8.0+236+2d3cbd4c ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgres-decoderbufs 1.9.7-1.Final.module_el9.3.0+52+21733919 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgresql +14 13.23-3.el9_8 ALSA-2026:28037, ALSA-2026:27741, ALSA-2026:26204
AlmaLinux 8 libpq +1 13.23-2.el8_10 ALSA-2026:27738
AlmaLinux 8 pg_repack 1.4.6-3.module_el8.6.0+2760+1746ec94 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 pgaudit 1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 postgres-decoderbufs 0.10.0-2.module_el8.6.0+2760+1746ec94 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 postgresql +12 13.23-3.module_el8.10.0+4198+7a62a2ce ALSA-2026:28208, ALSA-2026:28143, ALSA-2026:26181
AlmaLinux 8 postgresql-private-libs +1 15.18-1.module_el8.10.0+4195+4569d728 ALSA-2026:28143, ALSA-2026:26181

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 postgresql16 16.14-1.el10_2 RLSA-2026:27743
Rocky Linux 10 postgresql18 18.4-1.el10_2 RLSA-2026:27742
Rocky Linux 9 pg_repack 1.4.8-2.module+el9.7.0+40011+28af63c9 RLSA-2026:28037, RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 pgaudit 1.7.0-1.module+el9.7.0+40011+28af63c9 RLSA-2026:28037, RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 pgvector 0.6.2-2.module+el9.8.0+40159+adcaa225 RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 postgis 3.5.3-5.module+el9.8.0+40163+45adab57 RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.7.0+40011+28af63c9 RLSA-2026:28037, RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 postgresql 13.23-3.el9_8 RLSA-2026:27741
Rocky Linux 8 libpq 13.23-2.el8_10 RLSA-2026:27738
Rocky Linux 8 pg_repack 1.4.8-1.module+el8.9.0+1525+fc91df60 RLSA-2026:26181
Rocky Linux 8 pgaudit 1.7.0-1.module+el8.9.0+1525+fc91df60 RLSA-2026:26181
Rocky Linux 8 postgres-decoderbufs 1.9.7-1.Final.module+el8.9.0+1525+fc91df60 RLSA-2026:26181
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 postgresql14 14.23-160000.1.1 SUSE-SU-2026:22177-1
SLES for SAP 16.0 postgresql15 15.18-160000.1.1 SUSE-SU-2026:22183-1
SLES for SAP 16.0 postgresql16 16.14-160000.1.1 SUSE-SU-2026:22184-1
SLES for SAP 16.0 postgresql17 17.10-160000.1.1 SUSE-SU-2026:22149-1
SLES for SAP 16.0 postgresql18 18.4-160000.1.1 SUSE-SU-2026:22077-1
SLES 16.0 postgresql14 14.23-160000.1.1 SUSE-SU-2026:22177-1
SLES 16.0 postgresql15 15.18-160000.1.1 SUSE-SU-2026:22183-1
SLES 16.0 postgresql16 16.14-160000.1.1 SUSE-SU-2026:22184-1
SLES 16.0 postgresql17 17.10-160000.1.1 SUSE-SU-2026:22149-1
SLES 16.0 postgresql18 18.4-160000.1.1 SUSE-SU-2026:22077-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed postgresql14 14.23-1.1 openSUSE-SU-2026:10806-1
openSUSE Tumbleweed postgresql15 15.18-1.1 openSUSE-SU-2026:10807-1
openSUSE Tumbleweed postgresql16 16.14-1.1 openSUSE-SU-2026:10808-1
openSUSE Tumbleweed postgresql17 17.10-1.1 openSUSE-SU-2026:10809-1
openSUSE Tumbleweed postgresql18 18.4-1.1 openSUSE-SU-2026:10828-1
openSUSE Leap 16.0 postgresql14 14.23-160000.1.1 openSUSE-SU-2026:21102-1
openSUSE Leap 16.0 postgresql15 15.18-160000.1.1 openSUSE-SU-2026:21103-1
openSUSE Leap 16.0 postgresql16 16.14-160000.1.1 openSUSE-SU-2026:21104-1
openSUSE Leap 16.0 postgresql17 17.10-160000.1.1 openSUSE-SU-2026:20970-1
ReleasePackageFixed inAdvisory
Alpine v3.24 postgresql16 16.14-r0 —
Alpine v3.24 postgresql17 17.10-r0 —
Alpine v3.24 postgresql18 18.4-r0 —
Alpine v3.23 postgresql16 16.14-r0 —
Alpine v3.23 postgresql17 17.10-r0 —
Alpine v3.23 postgresql18 18.4-r0 —
Alpine v3.22 postgresql15 15.18-r0 —
Alpine v3.22 postgresql16 16.14-r0 —
Alpine v3.22 postgresql17 17.10-r0 —
Alpine v3.21 postgresql15 15.18-r0 —
Alpine v3.21 postgresql16 16.14-r0 —
Alpine v3.21 postgresql17 17.10-r0 —
Alpine v3.20 postgresql15 15.18-r0 —
Alpine v3.20 postgresql16 16.14-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 postgresql15 +15 15.18-1.amzn2023.0.1 ALAS2023-2026-1768
Amazon Linux 2023 postgresql16 +15 16.14-1.amzn2023.0.1 ALAS2023-2026-1767
Amazon Linux 2023 postgresql17 +15 17.10-1.amzn2023.0.1 ALAS2023-2026-1766
Amazon Linux 2023 postgresql18 +15 18.4-1.amzn2023.0.1 ALAS2023-2026-1780

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 postgresql 16.14-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 postgresql +14 16.14-1.0.1.el10_2 ELSA-2026-27743
Oracle Linux 10 postgresql18 +13 18.4-1.0.1.el10_2 ELSA-2026-27742
Oracle Linux 9 pg_repack 1.4.8-2.module+el9.8.0+90926+92e334e4 ELSA-2026-28037, ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 pgaudit 1.7.0-1.module+el9.8.0+90926+92e334e4 ELSA-2026-28037, ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 pgvector 0.6.2-2.module+el9.8.0+90925+e22a792e ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 postgis +4 3.5.3-5.module+el9.8.0+90925+e22a792e ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.8.0+90926+92e334e4 ELSA-2026-28037, ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 postgresql +14 13.23-3.el9_8 ELSA-2026-28037, ELSA-2026-27741, ELSA-2026-26204
Oracle Linux 8 libpq +1 13.23-2.el8_10 ELSA-2026-27738

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • abraxas/postgres-basebackup-symlink ★ 0 · Oct 12, 2026

    PostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 50

References