CVE-2026-6476

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

• CWE-89

• https://www.postgresql.org/support/security/CVE-2026-6476/Patch, Vendor Advisory

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6475Symlink following in PostgreSQL pg_basebackup plain format a…8.8
• CVE-2026-64751A use after free issue was addressed with improved memory ma…9.8
• CVE-2026-64754An out-of-bounds write issue was addressed with improved bou…5.5
• CVE-2026-64755An authorization issue was addressed with improved state man…5.5
• CVE-2026-64757A memory corruption issue was addressed with improved state …8.8
• CVE-2026-64758The issue was addressed with improved bounds checks. This is…7.8
• CVE-2026-64762An out-of-bounds read was addressed with improved bounds che…9.8
• CVE-2026-64763An out-of-bounds write issue was addressed by removing the v…7.8
• CVE-2026-64764An out-of-bounds write issue was addressed with improved bou…7.8
• CVE-2026-64765An integer overflow was addressed with improved input valida…7.8
• CVE-2026-64766An integer overflow was addressed with improved input valida…7.8
• CVE-2026-64767A buffer overflow was addressed with improved bounds checkin…9.8