CoreCVE
Back

HIGH

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Published May 14, 2026

Description

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

Remediation

Red Hat statement

This MODERATE symlink following vulnerability in PostgreSQL's pg_basebackup and pg_rewind allows an origin superuser to overwrite local files. Exploitation requires local access, high privileges (superuser), and specific intermediate actions before server restart. Impact is high to confidentiality, integrity, and availability if exploited. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23.

Weaknesses (2)

CWE-59

CWE-61

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner PostgreSQL
Published May 14, 2026
Updated May 15, 2026
Reserved Apr 17, 2026
Link CVE-2026-6475
CISA Vulnrichment
Updated May 14, 2026
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2026-6475
Red Hat
Severity Moderate
Public date May 14, 2026
Links CVE-2026-6475 - Bugzilla
ENISA EUVD
Assigner PostgreSQL
Published May 14, 2026
Updated May 15, 2026
Exploited since n/a
Link EUVD-2026-30286
EUVD-2026-30286