Index
Search
Search the public record. Drafts and scheduled notes are not included.
High
news
PostgreSQL pg_basebackup symlink overwrite is CVE-2026-6475
PostgreSQL's May 2026 minor releases fix CVE-2026-6475: symlink following in pg_basebackup plain format and pg_rewind lets an origin superuser overwrite local files and hijack the OS account. Practical mainly if data is moved or snapshotted before server start. CVSS 3.1 8.8. Not in CISA KEV. No confirmed public PoC of the original flaw.
Published 4h ago
HighNo PoC
CVE-2026-6475
PostgreSQL pg_basebackup and pg_rewind symlink file overwrite
Other
Published 14 May 2026