CVE-2026-15741CWE-89sql-injection

CVE-2026-15741

High · published August 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00466 · 39.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-13T17:17Z
Affected products (5)
ProductVersionsFixed in
postgresql/postgresql≥ 14.0, < 14.2414.24
postgresql/postgresql≥ 15.0, < 15.1915.19
postgresql/postgresql≥ 16.0, < 16.1516.15
postgresql/postgresql≥ 17.0, < 17.1117.11
postgresql/postgresql≥ 18.0, < 18.518.5
References (1)
https://www.postgresql.org/support/security/CVE-2026-15741/ · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
EPSS history
Timeline
  • 13 AUG 13:00Z
    PostgreSQL expression deparse allows SQL injection via EXTRACT argument
    cvelistv5