CVE-2026-6475
PostgreSQL pg_basebackup and pg_rewind symlink file overwrite
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind lets an origin superuser overwrite local files such as the postgres account shell profile and hijack the OS account. Practical only if files are moved or snapshotted between those commands and server start. Fixed in 18.4, 17.10, 16.14, 15.18, and 14.23. CVSS 3.1 8.8 (PostgreSQL). Not in CISA KEV.
- CVSS
- 8.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Class
- Other
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- PostgreSQL Global Development Group
- Products
- PostgreSQL
- Affected
- PostgreSQL 14 through 18 before the fixed minors: before 14.23, 15.18, 16.14, 17.10, and 18.4.
- Fixed
- 14.23, 15.18, 16.14, 17.10, and 18.4, published 14 May 2026.
- CWE
- CWE-61
- Published
- 14 May 2026
- Updated
- 12 Oct 2026
No public PoC is confirmed on this record.
CVE-2026-6475 is a symlink-following flaw in PostgreSQL client tools. In pg_basebackup plain format and in pg_rewind, an origin database superuser can cause the tools to overwrite unrelated local files. The PostgreSQL project gives the example of a shell profile under the postgres OS account, which can hijack that account.
PostgreSQL scores it CVSS 3.1 8.8 (High) and maps it to CWE-61. NVD lists the PostgreSQL score and marks the record Analyzed. The component is the client tools, not a remote unauthenticated server bug by itself. The operator must run the backup or rewind against a hostile origin.
The project stresses a narrow practical window. Starting the server after these commands already trusts the origin superuser for other reasons, such as shared_preload_libraries. The overwrite matters mainly if someone takes further action between the tools and server start, for example moving the data directory to another VM or snapshotting the VM.
Fixed minors shipped on 14 May 2026: 18.4, 17.10, 16.14, 15.18, and 14.23. The same release fixed ten other CVEs; this record covers only CVE-2026-6475. The CVE is not in the CISA KEV catalog. ThreatWire found no confirmed public proof-of-concept that demonstrates the original May 2026 flaw. A GitHub repository advertised against this CVE ID instead claims a leftover issue on a later minor and is treated separately in related coverage.