CVE-2026-6638

Name	CVE-2026-6638
Description	SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6270-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postgresql-17 (PTS)	trixie	17.9-0+deb13u1	vulnerable
	trixie (security)	17.10-0+deb13u1	fixed
postgresql-18 (PTS)	forky	18.3-1	vulnerable
	sid	18.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
postgresql-17	source	trixie	17.10-0+deb13u1	DSA-6270-1
postgresql-17	source	(unstable)	(unfixed)
postgresql-18	source	(unstable)	18.4-1

https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/