PostgreSQL vulnerabilities and fixes

CVEs that mention PostgreSQL, ranked by priority. 27 tracked.

PostgreSQL has 27 tracked vulnerabilities, 4 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 18. Most recent: 2026-10-23. Highest priority: CVE-2026-9586 (score 97/100).

• CVE-2026-9586 CRITICAL 9.8 EXPLOITED UPGRADE Sangoma Switchvox SQL Injection Vulnerability
• CVE-2026-48031 CRITICAL 9.1 go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL
• CVE-2022-44566 HIGH 7.5 UPGRADE A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
• CVE-2026-16503 CRITICAL 9.1 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all i
• CVE-2026-114087 HIGH 8.1 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/
• CVE-2026-62238 HIGH 8.8 UPGRADE OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export
• CVE-2026-49004 MEDIUM 6.5 The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection
• CVE-2026-54368 HIGH 8.8 CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() t
• CVE-2026-17346 HIGH 8.8 UPGRADE The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple
• CVE-2026-17351 CRITICAL 9.0 UPGRADE The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's exec
• CVE-2026-19754 HIGH 8.6 Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function
• CVE-2026-48080 HIGH 8.0 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
• CVE-2026-72775 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, wh
• CVE-2026-63120 HIGH 8.4 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
• CVE-2026-50736 HIGH 7.5 UPGRADE The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to
• CVE-2026-76298 HIGH 8.8 In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk
• CVE-2026-50737 HIGH 7.5 UPGRADE When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affect
• CVE-2026-47769 MEDIUM 5.3 APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server en
• CVE-2026-50735 MEDIUM 6.8 UPGRADE pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication p
• CVE-2026-71276 HIGH 7.1 Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/htt
• CVE-2026-115883 MEDIUM 6.0 LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and
• CVE-2026-62845 MEDIUM 4.7 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-68563 MEDIUM 5.5 A flaw was found in ansible-collection-redhat-leapp
• CVE-2026-104947 MEDIUM 5.3 WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the b
• CVE-2026-115400 MEDIUM 4.4 crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database r
• CVE-2026-54238 LOW 3.1 Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets
• CVE-2026-54711 LOW 2.4 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores

FAQ

How do I fix PostgreSQL vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is PostgreSQL being exploited right now?

Yes: 1 PostgreSQL CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which PostgreSQL CVE should I patch first?

CVE-2026-9586 currently ranks highest (97/100): Sangoma Switchvox SQL Injection Vulnerability.

← Back to latest CVEs