PostgreSQL CVE-2026-6476: SQL Injection Grants Superuser Access

The National Vulnerability Database has disclosed CVE-2026-6476, a high-severity SQL injection vulnerability in PostgreSQL’s pg_createsubscriber function. This flaw allows an attacker with pg_create_subscription rights to execute arbitrary SQL commands as a superuser. The attack is not immediate; it takes effect the next time pg_createsubscriber runs.

This vulnerability impacts minor versions of PostgreSQL within major versions 17 and 18. Specifically, versions before PostgreSQL 18.4 and 17.10 are affected. Older PostgreSQL versions (before 17) are not susceptible to this specific flaw. The CVSS score for CVE-2026-6476 is 7.2 (HIGH), reflecting the significant impact of privilege escalation to superuser.

For defenders, this is a critical reminder that even administrative functions can harbor severe weaknesses. The attacker’s calculus here is clear: gain a foothold, then leverage existing, seemingly benign administrative permissions to escalate privileges and achieve full control over the database. This isn’t about external attackers; it’s about insider threats or compromised accounts with specific database privileges becoming superusers.