Skip to main content

PostgreSQL psql CVE-2026-6464

| EUVDEUVD-2026-57854 HIGH
Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
2026-08-13 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 GHSA-j447-m374-x28h
PostgreSQL Code Injection
8.1
CVSS 3.1 · Vendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Share

Severity by source

Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

AC:H reflects the dual-control requirement over both server and data rows; AV:N because the attack is delivered via the PostgreSQL wire protocol from a remote malicious server; PR:N as no client-side privileges are required from the attacker.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007).

CVSS VectorVendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 14:02 EUVD
Analysis Generated
Aug 13, 2026 - 13:43 vuln.today
CVE Published
Aug 13, 2026 - 13:19 cve.org
HIGH 8.1

DescriptionCVE.org

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Articles & Coverage 2

News 18 New PostgreSQL Vulnerabilities - 18 High Severity, No POC Available Aug 14, 2026 News 18 New PostgreSQL Vulnerabilities - 18 High Severity, No POC Available Aug 13, 2026

AnalysisAI

Command injection in the PostgreSQL psql client (versions before 18.5, 17.11, 16.15, 15.19, and 14.24) allows an attacker who controls both a malicious server and the supplied data rows to execute arbitrary psql meta-commands on the connecting client host. The flaw is triggered when a COPY FROM STDIN or \copy FROM STDIN operation fails with a premature server-side error - before the server signals readiness to receive data rows - causing psql to misinterpret the inline data stream as client-side command input rather than row data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two simultaneously attacker-controlled elements: first, the ability to control or compromise the target PostgreSQL server sufficiently to cause a COPY FROM STDIN or \copy FROM STDIN operation to fail with a premature protocol error - before the server sends the CopyInResponse message that signals readiness for data rows; and second, control over the actual data rows supplied to that COPY command, which must contain embedded psql meta-commands. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The 8.1 CVSS score accurately captures worst-case impact but the AC:H rating is the critical moderating factor - reliable exploitation demands an attacker simultaneously control both the PostgreSQL server (to inject a premature protocol error) and the data rows supplied to the COPY command (to embed malicious meta-commands), a compound precondition that substantially limits opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade the psql client to PostgreSQL 18.5, 17.11, 16.15, 15.19, or 14.24 - the patched release corresponding to the major branch in use - as detailed in the vendor advisory at https://www.postgresql.org/support/security/CVE-2026-6464/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit all systems and applications using PostgreSQL psql client to determine which versions are deployed; flag any instances of versions before 18.5, 17.11, 16.15, 15.19, or 14.24. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-829 – Inclusion of Functionality from Untrusted Control Sphere

View all
CVE-2025-32463 CRITICAL POC
9.3
CVE-2026-0770 CRITICAL POC
9.8
CVE-2025-27607 HIGH POC
8.8
CVE-2026-1699 CRITICAL POC
10.0
CVE-2026-27941 CRITICAL POC
9.9
CVE-2020-8128 CRITICAL POC
9.8
CVE-2019-13589 CRITICAL POC
9.8
CVE-2018-15486 CRITICAL POC
9.1

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-6464 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy