PostgreSQL pg_basebackup symlink overwrite is CVE-2026-6475

What happened

On 14 May 2026 the PostgreSQL Global Development Group published minor releases 18.4, 17.10, 16.14, 15.18, and 14.23. The announcement covers eleven security fixes. One of them is CVE-2026-6475.

In pg_basebackup when the backup is written in plain format, and in pg_rewind, the tools can follow symbolic links while placing files on the client. An origin database superuser who controls the source can abuse that to overwrite unrelated local files. PostgreSQL's example is a shell profile under the postgres operating system account. Overwriting such a file can hijack that OS account when it next runs shell commands.

PostgreSQL scores the issue CVSS 3.1 8.8 (High) and maps it to CWE-61. NVD carries the same PostgreSQL score. Red Hat publishes a lower 6.7 score with a different vector that treats privileges and attack vector more narrowly. ThreatWire keeps the PostgreSQL project score as the primary published figure.

The same May release also fixed CVE-2026-6472 through CVE-2026-6479, plus CVE-2026-6575, CVE-2026-6637, and CVE-2026-6638. This article is only about CVE-2026-6475.

Who is affected

Supported branches 14 through 18 were vulnerable before the fixed minors. Upgrade targets are 14.23, 15.18, 16.14, 17.10, and 18.4.

The risk sits with operators who run pg_basebackup (plain format) or pg_rewind against a source they do not fully trust, including a compromised origin where an attacker already has superuser. Tar-format base backups that are not extracted by the same unsafe path are outside the plain-format case described in the advisory.

PostgreSQL 14 reaches end of life on 12 November 2026. Hosts still on 14 should plan a major-version move after applying 14.23.

What is confirmed

PostgreSQL's security page and release announcement confirm symlink following, the origin-superuser attacker model, OS-account hijack via overwritten local files, the fixed versions, and the CVSS 8.8 score. Credits include Valery Gubanov, Tencent Xuanwu Lab's XlabAI team, and several other reporters.

The project itself narrows the practical impact. After pg_basebackup or pg_rewind, starting the server already trusts the origin superuser for other reasons, for example through shared_preload_libraries. The overwrite is mainly useful if someone takes a further step between those commands and server start. PostgreSQL names moving the files to a different VM or snapshotting the VM as examples.

The CVE is not in the CISA KEV catalog (checked against catalog 2026.10.08). ThreatWire found no dedicated write-ups from BleepingComputer, The Record, or SecurityWeek focused on this CVE. Coverage is mostly the PostgreSQL announcement plus vendor CVE databases such as NVD, GitHub's unreviewed advisory, Red Hat, and Microsoft's update guide.

ThreatWire found no confirmed public proof-of-concept for the original May 2026 flaw. Availability is therefore none for this CVE record.

What is not confirmed

Exploitation in the wild is not claimed by PostgreSQL or CISA.

A GitHub repository created on 12 October 2026 under the account abraxas, titled for postgres basebackup symlink behavior, is sometimes linked next to this CVE ID. Its README does not claim to reproduce the pre-fix CVE-2026-6475 bug. It claims a leftover absolute symlink-target issue on PostgreSQL 18.6, after the May fixes, and says there is "no CVE yet" for that leftover. The account was created in July 2026 and hosts a large number of CVE-titled repositories in a short period. ThreatWire did not run the project and does not treat it as a confirmed PoC of CVE-2026-6475.

Claims that every basebackup of a replica is immediately catastrophic without the move-or-snapshot step overstate PostgreSQL's own wording.

What to do

Upgrade PostgreSQL client and server packages to 18.4, 17.10, 16.14, 15.18, or 14.23 (or later on those lines). Minor updates do not require dump and reload.

Treat pg_basebackup and pg_rewind against untrusted origins as sensitive operations. Prefer tar format when that matches your restore process, and review where plain-format output is written. Do not move or snapshot a freshly pulled data directory into a more trusted environment until you have upgraded and verified the source.

If you already copied data produced by vulnerable tools from a hostile origin into another host, assume that host's postgres OS account may have been subverted. Rebuild from a trusted backup and rotate credentials.

Sources: PostgreSQL security page for CVE-2026-6475, the 14 May 2026 minor release announcement, NVD, CVE.org, GHSA-7h2q-899j-9636, Red Hat's CVE page, and CISA KEV (not listed).