What is the CVSS score of CVE-2026-6638?

CVE-2026-6638 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-6638?

Yes, a patch is available for CVE-2026-6638. Update the affected software to the latest version immediately.

PostgreSQL CVE-2026-6638

EUVD-2026-30290 LOW

SQL Injection (CWE-89)

2026-05-14 PostgreSQL

GHSA-3835-x2rj-c3qj

PostgreSQL SQLi

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 14, 2026 - 15:01 EUVD

Analysis Generated

May 14, 2026 - 14:03 vuln.today

CVE Published

May 14, 2026 - 13:00 nvd

LOW 3.7

DescriptionCVE.org

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

AnalysisAI

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION REFRESH PUBLICATION allows authenticated local or network users with table creation privileges to execute arbitrary SQL queries with the publication subscriber's credentials. The attack is deferred until the next REFRESH PUBLICATION command is executed, requiring user interaction or scheduled maintenance. PostgreSQL 16.x, 17.x, and 18.x versions prior to 16.14, 17.10, and 18.4 respectively are vulnerable; earlier versions are unaffected. No public exploit code or active exploitation has been identified.

Technical ContextAI

PostgreSQL's logical replication subsystem enables subscribers to replicate tables from a remote publisher using subscription objects. The ALTER SUBSCRIPTION command with REFRESH PUBLICATION parameter automatically detects schema changes on the publisher side. The vulnerability stems from insufficient input validation (CWE-89: SQL injection) in how subscription metadata is processed when refreshing table definitions. An attacker with CREATE TABLE privileges on the subscriber can craft malicious table definitions that, when matched against publisher schemas during refresh, inject SQL commands executed in the context of the replication worker process, which runs with the publisher connection's credentials.

RemediationAI

Upgrade to PostgreSQL 16.14, 17.10, 18.4, or any subsequent release in the respective major version series. For organizations unable to patch immediately, implement role-based access control (RBAC) restricting CREATE TABLE privileges on subscribers to trusted database administrators only, preventing untrusted users from injecting malicious table definitions. Alternatively, disable automatic schema refresh by avoiding ALTER SUBSCRIPTION REFRESH PUBLICATION commands in favor of manual table management, accepting the operational burden of synchronizing schema changes. Monitor logical replication worker logs for unexpected SQL execution. These workarounds maintain replication functionality while reducing exploit surface, though they impose administrative overhead and may delay detection of intentional schema changes. Security advisory available at https://www.postgresql.org/support/security/CVE-2026-6638/.