{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-14T13:00:15Z",
  "bugzilla" : {
    "description" : "postgresql: PostgreSQL: Arbitrary SQL execution via SQL injection in logical replication",
    "id" : "2477446",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2477446"
  },
  "cvss3" : {
    "cvss3_base_score" : "3.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-89",
  "details" : [ "SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials.  The attack takes effect at the next REFRESH PUBLICATION.  Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected.  Versions before PostgreSQL 16 are unaffected.", "A flaw was found in PostgreSQL. This SQL injection vulnerability exists within the logical replication feature, specifically when using the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command. A malicious subscriber table creator can exploit this flaw to execute arbitrary SQL commands with the elevated privileges of the subscription's publication-side credentials. The attack is triggered when the REFRESH PUBLICATION command is next executed." ],
  "statement" : "SQL injection in PostgreSQL logical replication allows a subscriber-side table creator to execute arbitrary SQL on the publisher using the subscription's publication-side credentials. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates subscriber-side schema and relation names into SQL sent to the publisher without properly quoting them; a crafted relation name can therefore inject arbitrary SQL that runs with the privileges of the subscription's publication-side role the next time REFRESH PUBLICATION is executed. Exploitation requires the attacker to already hold table-creation privileges on the subscriber database, for logical replication to be configured with an untrusted subscriber-side user, and for a privileged user to subsequently run REFRESH PUBLICATION, which limits the practical attack surface for most default deployments. Only PostgreSQL major versions 16, 17, and 18 are affected; versions prior to 16 do not include the vulnerable code path (introduced by commit 875693019053b8897ec3983e292acbb439b088c3).",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27742",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "postgresql18-0:18.4-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27743",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "postgresql16-0:16.14-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-06-22T00:00:00Z",
    "advisory" : "RHSA-2026:27718",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "postgresql16-0:16.14-1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-06-23T00:00:00Z",
    "advisory" : "RHSA-2026:28143",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "postgresql:16-8100020260530205218.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-06-16T00:00:00Z",
    "advisory" : "RHSA-2026:26203",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "postgresql:16-9080020260605131007.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-06-16T00:00:00Z",
    "advisory" : "RHSA-2026:26204",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "postgresql:18-9080020260605125734.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26524",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "postgresql:16-9040020260612132455.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26525",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "postgresql:16-9060020260612084605.rhel9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:21182",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "postgresql17-main-17.10-0.1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-03T00:00:00Z",
    "advisory" : "RHSA-2026:22878",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "postgresql18-main-18.4-0.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "postgresql:12/postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "postgresql:15/postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "postgresql:15/postgresql",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Not affected",
    "package_name" : "ansible-automation-platform/bootc-automation-portal-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-6638\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6638\nhttps://www.postgresql.org/support/security/CVE-2026-6638/" ],
  "name" : "CVE-2026-6638",
  "mitigation" : {
    "value" : "Upgrade to PostgreSQL 18.4, 17.10, or 16.14 (matching your major version) or later, which corrects the identifier quoting used when the subscriber's apply worker sends the REFRESH PUBLICATION SQL to the publisher. Versions prior to PostgreSQL 16 are not affected. As a temporary mitigation, restrict CREATE TABLE / table-ownership privileges on subscriber databases to trusted roles only, avoid configuring logical replication subscriptions for untrusted subscriber-side users, and scope the subscription's publication-side credentials to the minimum privileges necessary.",
    "lang" : "en:us"
  },
  "csaw" : false
}