CVE-2026-6475: PostgreSQL Symlink Vulnerability Allows Superuser Hijack

The National Vulnerability Database has detailed CVE-2026-6475, a symlink following vulnerability in PostgreSQL’s pg_basebackup (plain format) and pg_rewind utilities. This flaw allows an originating superuser to overwrite local files, such as /var/lib/postgres/.bashrc, which can lead to the hijacking of the operating system account. This isn’t a direct remote code execution, but a post-exploitation path that can be leveraged.

The attack’s practical implications hinge on specific actions taken between the execution of these commands and the server’s restart. For instance, moving affected files to a different VM or snapshotting the VM between the compromise and server restart would enable the attack. The core issue is that starting the server after these commands implicitly trusts the origin superuser, especially due to features like shared_preload_libraries which can be exploited for privilege escalation.

Versions of PostgreSQL prior to 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. The National Vulnerability Database assigns this a CVSS score of 8.8 (HIGH), underscoring the severity of potential account takeover and subsequent system compromise. Defenders need to understand that this is a trust exploitation scenario, not a zero-day RCE, but it opens a door for a malicious insider or an attacker who has already gained superuser privileges to establish persistence and further compromise the system.