First Published: 2026/08/13
Important: This assessment evaluates the impact of CVE-2026-18408 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.
Summary
The psql \unrestrict meta-command bypasses the input-expansion restriction introduced to fix CVE-2025-8714, allowing a malicious superuser of a pg_dump origin server to inject arbitrary code for execution in the psql client during dump restoration. pg_dump, pg_dumpall, and pg_restore (when generating plain-format dumps) are affected. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Vulnerability details
CVE-ID: CVE-2026-18408
CVE Publish Date: 2026/08/13
CVSS Base Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products and versions
PostgreSQL
- All versions prior to 18.5
- All versions prior to 17.11
- All versions prior to 16.15
- All versions prior to 15.19
- All versions prior to 14.24
EnterpriseDB Postgres Advanced Server (EPAS)
- All versions prior to 18.5
- All versions prior to 17.11
- All versions prior to 16.15
- All versions prior to 15.19
- All versions prior to 14.24
EnterpriseDB Postgres Extended (PGE)
- All versions prior to 18.5
- All versions prior to 17.11
- All versions prior to 16.15
- All versions prior to 15.19
- All versions prior to 14.24
CloudNativePG
- All operand versions prior to 18.5
- All operand versions prior to 17.11
- All operand versions prior to 16.15
- All operand versions prior to 15.19
- All operand versions prior to 14.24
Remediation/fixes
PostgreSQL
| Affected Version | Fixed In | Fix Published |
|---|---|---|
| prior to 18.5 | 18.5 | 2026-08-13 |
| prior to 17.11 | 17.11 | 2026-08-13 |
| prior to 16.15 | 16.15 | 2026-08-13 |
| prior to 15.19 | 15.19 | 2026-08-13 |
| prior to 14.24 | 14.24 | 2026-08-13 |
EDB Postgres Extended Server
| Affected Version | Fixed In | Fix Published |
|---|---|---|
| prior to 18.5 | 18.5 | 2026-08-13 |
| prior to 17.11 | 17.11 | 2026-08-13 |
| prior to 16.15 | 16.15 | 2026-08-13 |
| prior to 15.19 | 15.19 | 2026-08-13 |
| prior to 14.24 | 14.24 | 2026-08-13 |
EDB Postgres Advanced Server
| Affected Version | Fixed In | Fix Published |
|---|---|---|
| prior to 18.5 | 18.5 | 2026-08-13 |
| prior to 17.11 | 17.11 | 2026-08-13 |
| prior to 16.15 | 16.15 | 2026-08-13 |
| prior to 15.19 | 15.19 | 2026-08-13 |
| prior to 14.24 | 14.24 | 2026-08-13 |
CloudNativePG
Customer should update to the fixed version of the PostgreSQL operands.
References
- CVSS Calculator v3.1
- NVD - CVE-2026-18408 Detail
- https://www.postgresql.org/support/security/CVE-2026-18408/
Related information
Acknowledgement
Source: PostgreSQL.org