THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-18408 (HIGH 8.8) — Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The f

[NVD] CVE-2026-18408 (HIGH 8.8) — Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The f

mednvdPublished 2026-08-13

CVE-2026-18408 CVSS: 8.8 HIGH Published: 2026-08-13T13:17:48.127

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestr

Indicators of compromise

CVE-2026-18408cve
CVE-2025-8714cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-18408