CVE-2026-6638: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in PostgreSQL
CVE-2026-6638 is a low-severity SQL injection vulnerability in PostgreSQL affecting logical replication commands. Specifically, the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command allows a subscriber table creator to execute arbitrary SQL using the publication-side credentials. This vulnerability impacts PostgreSQL major versions 16, 17, and 18, but only in minor versions before 16.14, 17.10, and 18.4. Versions prior to 16 are not affected. The attack executes at the next REFRESH PUBLICATION operation. No known exploits are reported in the wild, and no official patch or remediation level has been provided yet.
AI Analysis
Technical Summary
This vulnerability involves improper neutralization of special elements in an SQL command within PostgreSQL's logical replication feature. A subscriber table creator can exploit the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command to run arbitrary SQL commands with the publication-side credentials. The issue affects PostgreSQL versions 16, 17, and 18, specifically minor versions before 16.14, 17.10, and 18.4. The vulnerability is triggered during the REFRESH PUBLICATION operation. It has a CVSS 3.1 base score of 3.7, indicating low severity, with network attack vector, high attack complexity, low privileges required, and user interaction needed. No official fix or patch information is currently available.
Potential Impact
Successful exploitation allows a subscriber table creator to execute arbitrary SQL commands with the privileges of the publication-side, potentially leading to limited confidentiality and integrity impacts. The CVSS score of 3.7 reflects low severity, indicating limited impact. There are no reports of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with subscription table creators and the use of REFRESH PUBLICATION commands. Monitor PostgreSQL vendor communications for updates on patches or mitigations.
CVE-2026-6638: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in PostgreSQL
Description
CVE-2026-6638 is a low-severity SQL injection vulnerability in PostgreSQL affecting logical replication commands. Specifically, the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command allows a subscriber table creator to execute arbitrary SQL using the publication-side credentials. This vulnerability impacts PostgreSQL major versions 16, 17, and 18, but only in minor versions before 16.14, 17.10, and 18.4. Versions prior to 16 are not affected. The attack executes at the next REFRESH PUBLICATION operation. No known exploits are reported in the wild, and no official patch or remediation level has been provided yet.
CVSS v3.1
Score 3.7low
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves improper neutralization of special elements in an SQL command within PostgreSQL's logical replication feature. A subscriber table creator can exploit the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command to run arbitrary SQL commands with the publication-side credentials. The issue affects PostgreSQL versions 16, 17, and 18, specifically minor versions before 16.14, 17.10, and 18.4. The vulnerability is triggered during the REFRESH PUBLICATION operation. It has a CVSS 3.1 base score of 3.7, indicating low severity, with network attack vector, high attack complexity, low privileges required, and user interaction needed. No official fix or patch information is currently available.
Potential Impact
Successful exploitation allows a subscriber table creator to execute arbitrary SQL commands with the privileges of the publication-side, potentially leading to limited confidentiality and integrity impacts. The CVSS score of 3.7 reflects low severity, indicating limited impact. There are no reports of exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with subscription table creators and the use of REFRESH PUBLICATION commands. Monitor PostgreSQL vendor communications for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-04-19T19:58:21.650Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a05cfeaec166c07b0e13e2a
Added to database: 5/14/2026, 1:36:42 PM
Last enriched: 5/21/2026, 3:48:44 PM
Last updated: 6/15/2026, 2:05:54 PM
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.