ByteOS Network

NVD Vulnerability Details :

CVE-2026-6638

Analyzed

Source-f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Published At-14 May, 2026 | 14:16

Updated At-18 May, 2026 | 14:14

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 3.7

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CPE Matches

The PostgreSQL Global Development Group

>>postgresql>>Versions from 16.0(inclusive) to 16.14(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

The PostgreSQL Global Development Group

>>postgresql>>Versions from 17.0(inclusive) to 17.10(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

The PostgreSQL Global Development Group

>>postgresql>>Versions from 18.0(inclusive) to 18.4(exclusive)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Secondary	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

CWE ID: CWE-89

Type: Secondary

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

References

Hyperlink	Source	Resource
https://www.postgresql.org/support/security/CVE-2026-6638/	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007	Patch Vendor Advisory

Hyperlink: https://www.postgresql.org/support/security/CVE-2026-6638/

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Resource:

Patch

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History