Description
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PostgreSQL | 18 – < 18.4, 17 – < 17.10 | 18.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgresql-18 | 18.4-1 | — |
| Debian 13 | postgresql-17 | 17.10-0+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | postgresql-18 | 18.4-0ubuntu0.26.04.1 | — |
| Ubuntu 25.10 | postgresql-17 | 17.10-0ubuntu0.25.10.1 | — |
| Ubuntu 24.04 LTS | postgresql-16 | 16.14-0ubuntu0.24.04.1 | — |
| Ubuntu 22.04 LTS | postgresql-14 | 14.23-0ubuntu0.22.04.1 | — |
| Ubuntu 20.04 LTS | postgresql-12 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | postgresql-10 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | postgresql-9.5 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | postgresql-9.3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | postgresql18 +13 | 18.4-1.el10_2 | RHSA-2026:67280, RHSA-2026:27742 |
| RHEL 9 | pg_repack | 1.5.3-1.module+el9.8.0+23739+1c42644c | RHSA-2026:67848, RHSA-2026:26204 |
| RHEL 9 | pgaudit | 18.0-1.module+el9.8.0+23739+1c42644c | RHSA-2026:67848, RHSA-2026:26204 |
| RHEL 9 | pgvector | 0.8.1-1.module+el9.8.0+23739+1c42644c | RHSA-2026:67848, RHSA-2026:26204 |
| RHEL 9 | postgis +4 | 3.6.1-2.module+el9.8.0+23739+1c42644c | RHSA-2026:67848, RHSA-2026:26204 |
| RHEL 9 | postgres-decoderbufs | 3.3.1-1.Final.module+el9.8.0+23739+1c42644c | RHSA-2026:67848, RHSA-2026:26204 |
| RHEL 9 | postgresql +14 | 18.4-2.module+el9.8.0+24359+da7fad50 | RHSA-2026:67848, RHSA-2026:26204 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | postgresql +14 | 18.4-0.1.hum1 | RHSA-2026:22878 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | postgresql18 +13 | 18.4-1.el10_2 | ALSA-2026:67280, ALSA-2026:27742 |
| AlmaLinux 9 | pg_repack | 1.5.3-1.module_el9.8.0+234+5456f35d | ALSA-2026:67848, ALSA-2026:26204 |
| AlmaLinux 9 | pgaudit | 18.0-1.module_el9.8.0+234+5456f35d | ALSA-2026:67848, ALSA-2026:26204 |
| AlmaLinux 9 | pgvector | 0.8.1-1.module_el9.8.0+234+5456f35d | ALSA-2026:67848, ALSA-2026:26204 |
| AlmaLinux 9 | postgis +4 | 3.6.1-2.module_el9.8.0+239+6fb51d38 | ALSA-2026:67848, ALSA-2026:26204 |
| AlmaLinux 9 | postgres-decoderbufs | 3.3.1-1.Final.module_el9.8.0+234+5456f35d | ALSA-2026:67848, ALSA-2026:26204 |
| AlmaLinux 9 | postgresql +14 | 18.4-2.module_el9.8.0+280+5ad12178 | ALSA-2026:67848, ALSA-2026:26204 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | postgresql18 | 18.6-1.el10_2 | RLSA-2026:67280 |
| Rocky Linux 9 | pg_repack | 1.5.3-1.module+el9.8.0+40158+490b3c67 | RLSA-2026:67848 |
| Rocky Linux 9 | pgaudit | 18.0-1.module+el9.8.0+40158+490b3c67 | RLSA-2026:67848 |
| Rocky Linux 9 | pgvector | 0.8.1-1.module+el9.8.0+40158+490b3c67 | RLSA-2026:67848 |
| Rocky Linux 9 | postgres-decoderbufs | 3.3.1-1.Final.module+el9.8.0+40158+490b3c67 | RLSA-2026:67848 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | postgresql17 | 17.10-160000.1.1 | SUSE-SU-2026:22149-1 |
| SLES for SAP 16.0 | postgresql18 | 18.4-160000.1.1 | SUSE-SU-2026:22077-1 |
| SLES 16.0 | postgresql17 | 17.10-160000.1.1 | SUSE-SU-2026:22149-1 |
| SLES 16.0 | postgresql18 | 18.4-160000.1.1 | SUSE-SU-2026:22077-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql17 | 17.10-1.1 | openSUSE-SU-2026:10809-1 |
| openSUSE Tumbleweed | postgresql18 | 18.4-1.1 | openSUSE-SU-2026:10828-1 |
| openSUSE Leap 16.0 | postgresql17 | 17.10-160000.1.1 | openSUSE-SU-2026:20970-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | postgresql17 | 17.10-r0 | — |
| Alpine v3.24 | postgresql18 | 18.4-r0 | — |
| Alpine v3.23 | postgresql17 | 17.10-r0 | — |
| Alpine v3.23 | postgresql18 | 18.4-r0 | — |
| Alpine v3.22 | postgresql17 | 17.10-r0 | — |
| Alpine v3.21 | postgresql17 | 17.10-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | postgresql17 +15 | 17.10-1.amzn2023.0.1 | ALAS2023-2026-1766 |
| Amazon Linux 2023 | postgresql18 +15 | 18.4-1.amzn2023.0.1 | ALAS2023-2026-1780 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | postgresql18 +13 | 18.4-1.0.1.el10_2 | ELSA-2026-27742 |
| Oracle Linux 9 | pg_repack | 1.5.3-1.module+el9.8.0+90922+3defa420 | ELSA-2026-67848 |
| Oracle Linux 9 | pgaudit | 18.0-1.module+el9.8.0+90922+3defa420 | ELSA-2026-67848 |
| Oracle Linux 9 | pgvector | 0.8.1-1.module+el9.8.0+90922+3defa420 | ELSA-2026-67848 |
| Oracle Linux 9 | postgis +4 | 3.6.1-4.module+el9.8.0+91037+efa47639 | ELSA-2026-67848 |
| Oracle Linux 9 | postgres-decoderbufs | 3.3.1-1.Final.module+el9.8.0+90922+3defa420 | ELSA-2026-67848 |
| Oracle Linux 9 | postgresql +14 | 18.6-1.module+el9.8.0+91037+efa47639 | ELSA-2026-67848 |
Advisories 21
- ALSA-2026:27742 Important: postgresql18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26204 Important: postgresql:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67848 Important: postgresql:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67280 Important: postgresql18 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1544 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:67848 Red Hat Security Advisory: postgresql:18 security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:67280 Red Hat Security Advisory: postgresql18 security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:27742 Red Hat Security Advisory: postgresql18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26204 Red Hat Security Advisory: postgresql:18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:22878 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RLSA-2026:67848 Important: postgresql:18 security update Rocky Linux Security Advisories · Sep 16, 2026
- ELSA-2026-67848 Important: postgresql:18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 16, 2026
- RLSA-2026:67280 Important: postgresql18 security update Rocky Linux Security Advisories · Sep 15, 2026
- ELSA-2026-27742 Important: postgresql18 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- openSUSE-SU-2026:20970-1 Security update for postgresql17 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22149-1 Security update for postgresql17 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22077-1 Security update for postgresql18 SUSE / openSUSE Security Updates · Jun 16, 2026
- ALAS2023-2026-1780 Important: postgresql18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- ALAS2023-2026-1766 Important: postgresql17 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
- openSUSE-SU-2026:10828-1 libecpg6-18.4-1.1 on GA media SUSE / openSUSE Security Updates · May 21, 2026
- openSUSE-SU-2026:10809-1 postgresql17-17.10-1.1 on GA media SUSE / openSUSE Security Updates · May 19, 2026