CVE-2026-116314
PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation
Description
Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
INFO
Published Date :
Nov. 12, 2026, 2:15 p.m.
Last Modified :
Nov. 12, 2026, 2:15 p.m.
Remotely Exploit :
Yes !
Source :
PostgreSQL
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update PostgreSQL to a secure version.
- Apply vendor-supplied patches.
- Validate archive provider security.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-116314 vulnerability anywhere in the article.