CVE-2026-15741 is a SQL injection vulnerability in PostgreSQL's EXTRACT() expression deparse. An attacker with object owner privileges can craft a hostile object definition that leads to arbitrary SQL execution as a superuser. This vulnerability affects expression deparse consumers broadly, including core tools such as pg_dump and psql commands (e.g., \sf), as well as non-core tools that use similar functionality. Versions before PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 are affected. A patch is available to address this issue.

Successful exploitation allows an object owner to execute arbitrary SQL commands with superuser privileges, potentially leading to full database compromise. The vulnerability affects multiple PostgreSQL versions and impacts core database tools and utilities that rely on expression deparse, increasing the risk of privilege escalation and unauthorized actions within the database environment.

A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 14.24 or later, 15.19 or later, 16.15 or later, 17.11 or later, or 18.6 or later to remediate the issue. Applying these official fixes will prevent exploitation of the SQL injection vulnerability in the EXTRACT() expression deparse functionality.