CVE-2026-6638CWE-89

PostgreSQL REFRESH PUBLICATION allows SQL injection via table name

Low · published May 14, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
7.2
In the wild
Unconfirmed
What it is

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-14T13:00Z
EPSS history
Timeline
  • 14 MAY 13:00Z
    PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
    cvelistv5