CVE-2026-41889 is a SQL injection vulnerability in the pgx PostgreSQL driver for Go, exploitable when the non-default simple protocol is used with dollar-quoted string literals containing attacker-controlled placeholders. This flaw allows potential manipulation of SQL queries, impacting data integrity with a low impact rating. The vulnerability requires multiple uncommon conditions, including specific application usage patterns, limiting its overall risk. Red Hat has issued an advisory with updated RPM packages for Red Hat Hardened Images, but no explicit patch for this CVE is detailed. Mitigation involves avoiding the non-default simple protocol or ensuring that dollar-quoted string literals do not contain attacker-controlled placeholders. The vulnerability is rated moderate by Red Hat due to its limited exploitability and specific conditions.

The vulnerability could allow an attacker to manipulate SQL queries under specific conditions, potentially affecting data integrity. The impact is considered low to moderate because exploitation requires uncommon usage of the non-default simple protocol and specific query constructions. There is no indication of known exploits in the wild. The flaw does not affect default configurations of the pgx driver, reducing the overall risk.

Red Hat recommends avoiding the use of the non-default simple protocol in applications using the pgx PostgreSQL driver for Go. If the simple protocol must be used, ensure that dollar-quoted string literals do not contain attacker-controlled placeholder values. Configuring applications to use the default extended protocol prevents this vulnerability. No official patch is explicitly stated in the advisory; users should follow vendor guidance and apply updates to Red Hat Hardened Images RPMs as available.