CVE-2026-18408 in PostgreSQL
Summary
by MITRE • 08/13/2026
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical code execution flaw in PostgreSQL's dump and restore functionality that stems from improper handling of untrusted data during the pg_dump process. The vulnerability specifically affects the interaction between pg_dump and psql's \restrict meta-command, creating a path for malicious superusers to inject arbitrary code that executes with the privileges of the operating system account running psql during restore operations. The flaw exists because pg_dump fails to properly sanitize or validate data that gets processed through the \restrict meta-command, allowing attackers to manipulate the restore process and execute unauthorized commands on the target system. This represents a classic command injection vulnerability where user-controlled input is directly incorporated into system commands without proper sanitization.
The technical implementation of this vulnerability leverages PostgreSQL's internal meta-command processing system, specifically targeting how psql handles the \restrict command during dump restoration. When pg_dump creates a backup that includes data processed through \restrict, malicious superusers can craft input that gets expanded during restore operations, effectively bypassing normal security boundaries. The attack vector is particularly dangerous because it requires only superuser privileges on the source server, making it accessible to attackers who have elevated database access. The vulnerability affects multiple PostgreSQL versions and encompasses not just pg_dump but also pg_dumpall and pg_restore when working with plain-format dumps, indicating a systemic issue in how these tools handle meta-command input expansion.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it can enable attackers to execute arbitrary code on the target system with the same privileges as the psql process. This creates potential for complete system compromise, data exfiltration, and persistent access through the restored database environment. The vulnerability affects both the source server where pg_dump is executed and the target system where pg_restore operates, making it particularly dangerous in multi-server environments or when automated backup processes are in place. Organizations using PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24 face significant risk if they have superuser accounts with access to the database environment, as these systems can be exploited for unauthorized code execution.
The fix implemented for CVE-2025-8714 introduced \restrict and \unrestrict commands specifically to address this vulnerability, but analysis reveals that \unrestrict itself contained sufficient attack vectors to maintain the exploitability of the system. This demonstrates a flawed security implementation where the attempted mitigation created new vulnerabilities rather than resolving existing ones. Organizations should implement immediate mitigations including upgrading to patched PostgreSQL versions, implementing strict access controls for superuser accounts, and monitoring database activities for suspicious \restrict or \unrestrict usage patterns. The vulnerability aligns with CWE-94 (External Control of Code Generation) and follows attack patterns described in the MITRE ATT&CK framework under T1059 (Command and Scripting Interpreter) and T1078 (Valid Accounts) categories, representing both code injection and privilege escalation attack vectors. Additionally, this vulnerability highlights the importance of input validation in database management tools and demonstrates how meta-command processing can create unexpected security boundaries when not properly secured against user-controlled inputs.