EDB Security

Suggest edits

EDB is committed to a security first approach, from the products we build and the platforms we operate, to the services we provide our customers. Transparency is a core principle for the program and part of this effort includes welcoming incoming reports so that we can address concerns surfaced by our customers or security researchers. You’ll also find it in our advisories, which detail issues found and the required fixes or mitigations needed to keep your data and databases safe.

Policies

  • EDB Vulnerability Disclosure Policy

    This policy outlines how EnterpriseDB handles disclosures related to suspected vulnerabilities within our products, systems, or services. It also provides guidance for those who wish to perform security research, or may have discovered a potential security vulnerability impacting EDB.

Advisories

PostgreSQL CVE Assessments

Most Recent Advisories

CVE-2026-0949

  Read Advisory  Updated: 2026/01/16

PEM 9.8 Cross-site scripting

Postgres Enterprise Manager (PEM)
Summary:  PEM versions prior to 9.8.1 are affected by a stored Cross-Site Scripting (XSS) vulnerability that allows users with access to the “Manage Charts” menu to inject arbitrary Javascript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the “Manage Charts” menu.
Read More...

CVE-2025-2506

  Read Advisory  Published: 2025/05/22

pglogical 3.x, BDR/PGD 4.x and BDR/PGD 5.x allow unauthorized reads

All versions of pglogical 3.x, BDR/PGD 4.x and BDR/PGD 5.x prior to 3.7.26-ELS, 4.3.8-ELS and 5.8.0
Summary:  When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5.
Read More...

CVE-2025-14038

  Read Advisory  Updated: 2025/12/15

Unauthenticated gRPC API Access

Hybrid Manager (HM)
Summary:  EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This allows unauthorized access to critical internal gRPC APIs within a Hybrid Manager service due to missing authentication and authorization checks in the Istio Gateway configuration. This vulnerability has been remediated in EDB Hybrid Manager 1.3.3 and HM 2025.12, and customers should consider upgrading to the patched version as soon as possible.
Read More...

CVE-2024-4545

  Read Advisory  Updated: 2024/05/09

EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr

All versions of EDB Postgres Advanced Server (EPAS) edbldr from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0
Summary:  All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files to which they would not otherwise have access.
Read More...

CVE-2023-41120

  Read Advisory  Updated: 2025/01/31

EDB Postgres Advanced Server (EPAS) DBMS_PROFILER data may be removed without permission

All versions of EnterpriseDB Postgres Advanced Server (EPAS) prior to 11.21.32, 12.16.20, 13.12.17, 14.9.0, 15.4.0
Summary:  An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions.
Read More...

Most Recent Assessments

CVE-2026-2007

  Read Assessment  Published: 2026/02/12

PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

Postgresql 18.0 and 18.1, EDB Postgres Extended Server prior to 18.2.0, EDB Postgres Advanced Server prior to 18.2.0
Summary:  Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. Specifically affecting the pg_trgm extension, the vulnerability arises when crafted input causes an overflow, potentially leading to denial of service or privilege escalation.
Read More...

CVE-2026-2006

  Read Assessment  Published: 2026/02/12

PostgreSQL missing validation of multibyte character length executes arbitrary code

All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary:  Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. This can lead to arbitrary code execution as the operating system user running the database.
Read More...

CVE-2026-2005

  Read Assessment  Published: 2026/02/12

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary:  Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Insufficient validation of ciphertext length and structure before copying decrypted data into heap-allocated buffers leads to memory corruption.
Read More...

CVE-2026-2004

  Read Assessment  Published: 2026/02/12

PostgreSQL intarray extension selectivity estimator executes arbitrary code

All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary:  Improper validation of input types in the PostgreSQL intarray extension allows an object creator to execute arbitrary code as the operating system user running the database server. An authenticated user with object creation privileges can bypass type validation checks in the selectivity estimator function to compromise the underlying host.
Read More...

CVE-2025-8715

  Read Assessment  Updated: 2025/08/14

PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

All versions of Postgresql prior to 17.6, 16.10, 15.14, 14.19, 13.22 3.x, EDB Postgres Extended Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22, EDB Postgres Advanced Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22
Summary:  Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected.
Read More...

Could this page be better? Report a problem or suggest an addition!