Описание
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
A flaw was found in PostgreSQL. This SQL injection vulnerability exists within the logical replication feature, specifically when using the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command. A malicious subscriber table creator can exploit this flaw to execute arbitrary SQL commands with the elevated privileges of the subscription's publication-side credentials. The attack is triggered when the REFRESH PUBLICATION command is next executed.
Отчет
SQL injection in PostgreSQL logical replication allows a subscriber-side table creator to execute arbitrary SQL on the publisher using the subscription's publication-side credentials. ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates subscriber-side schema and relation names into SQL sent to the publisher without properly quoting them; a crafted relation name can therefore inject arbitrary SQL that runs with the privileges of the subscription's publication-side role the next time REFRESH PUBLICATION is executed. Exploitation requires the attacker to already hold table-creation privileges on the subscriber database, for logical replication to be configured with an untrusted subscriber-side user, and for a privileged user to subsequently run REFRESH PUBLICATION, which limits the practical attack surface for most default deployments. Only PostgreSQL major versions 16, 17, and 18 are affected; versions prior to 16 do not include the vulnerable code path (introduced by commit 875693019053b8897ec3983e292acbb439b088c3).
Меры по смягчению последствий
Upgrade to PostgreSQL 18.4, 17.10, or 16.14 (matching your major version) or later, which corrects the identifier quoting used when the subscriber's apply worker sends the REFRESH PUBLICATION SQL to the publisher. Versions prior to PostgreSQL 16 are not affected. As a temporary mitigation, restrict CREATE TABLE / table-ownership privileges on subscriber databases to trusted roles only, avoid configuring logical replication subscriptions for untrusted subscriber-side users, and scope the subscription's publication-side credentials to the minimum privileges necessary.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 7 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 8 | postgresql:12/postgresql | Not affected | ||
| Red Hat Enterprise Linux 8 | postgresql:15/postgresql | Not affected | ||
| Red Hat Enterprise Linux 9 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 9 | postgresql:15/postgresql | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Not affected | ||
| Red Hat Enterprise Linux 10 | postgresql18 | Fixed | RHSA-2026:27742 | 22.06.2026 |
| Red Hat Enterprise Linux 10 | postgresql16 | Fixed | RHSA-2026:27743 | 22.06.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | postgresql16 | Fixed | RHSA-2026:27718 | 22.06.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... ...
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
EPSS
3.7 Low
CVSS3