CVE-2017-12172Medium· 6.7▾ SunlitPostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
— → 6.7
none → medium
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.
postgresql = 9.2postgresql = 9.2.1postgresql = 9.2.2postgresql = 9.2.3postgresql = 9.2.4postgresql = 9.2.5postgresql = 9.2.6postgresql = 9.2.7postgresql = 9.2.8postgresql = 9.2.9postgresql = 9.2.10postgresql = 9.2.11postgresql = 9.2.12postgresql = 9.2.13postgresql = 9.2.14postgresql = 9.2.15postgresql = 9.2.16postgresql = 9.2.17postgresql = 9.2.18postgresql = 9.2.19postgresql = 9.2.20postgresql = 9.2.21postgresql = 9.2.22postgresql = 9.2.23postgresql = 9.3postgresql = 9.3.1postgresql = 9.3.2postgresql = 9.3.3postgresql = 9.3.4postgresql = 9.3.5postgresql = 9.3.6postgresql = 9.3.7postgresql = 9.3.8postgresql = 9.3.9postgresql = 9.3.10postgresql = 9.3.11postgresql = 9.3.12postgresql = 9.3.13postgresql = 9.3.14postgresql = 9.3.15postgresql = 9.3.16postgresql = 9.3.17postgresql = 9.3.18postgresql = 9.3.19postgresql = 9.4postgresql = 9.4.1postgresql = 9.4.2postgresql = 9.4.3postgresql = 9.4.4postgresql = 9.4.5postgresql = 9.4.6postgresql = 9.4.7postgresql = 9.4.8postgresql = 9.4.9postgresql = 9.4.10postgresql = 9.4.11postgresql = 9.4.12postgresql = 9.4.13postgresql = 9.4.14postgresql = 9.5postgresql = 9.5.1postgresql = 9.5.2postgresql = 9.5.3postgresql = 9.5.4postgresql = 9.5.5postgresql = 9.5.6postgresql = 9.5.7postgresql = 9.5.8postgresql = 9.5.9postgresql = 9.6postgresql = 9.6.1postgresql = 9.6.2postgresql = 9.6.3postgresql = 9.6.4postgresql = 9.6.5postgresql = 10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-1115Critical· 9.1postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile
CVE-2023-39417High· 7.5IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or "")
CVE-2026-6471High· 7.2Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin
CVE-2026-6470Medium· 4.3Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type
CVE-2026-6469Low· 3.8Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user
CVE-2026-6464High· 8.1Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection