CVE-2026-15741

Summary

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

VendorProductVersion RangeStatus
n/aPostgreSQL18 < 18.5affected
n/aPostgreSQL17 < 17.11affected
n/aPostgreSQL16 < 16.15affected
n/aPostgreSQL15 < 15.19affected
n/aPostgreSQL0 < 14.24affected

Weaknesses

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References