By PostgreSQL 18.4 shipped on May 14, 2026, alongside synchronized updates for every supported branch: 17.10, 16.14, 15.18, and 14.23. The release patches 11 security vulnerabilities and fixes over 60 bugs. Before you skip this one because it sounds routine: there is a CVSS 8.8 in here that lets an unprivileged database user execute code at the operating system level. And you can apply the whole patch by swapping binaries and restarting. No dump-and-reload, no pg_upgrade, no weekend maintenance window.
The One That Should Make You Stop Reading and Start Patching
CVE-2026-6637 is the headline. The PostgreSQL refint module — which handles referential integrity triggers — has a stack buffer overflow. An unprivileged database user can trigger it and execute arbitrary code as the OS user running PostgreSQL. No special role required. On top of that, if your application uses user-controlled values as refint cascade primary keys, there is a SQL injection path that runs as the database user.
That combination — unprivileged user to OS shell — is not common. It is exactly the kind of vulnerability that gets actively exploited. If you are running PostgreSQL with referential integrity triggers on a multi-tenant or internet-facing database, patch today.
Logical Replication Has Two New Injection Points
Logical replication is the backbone of most zero-downtime migrations, microservices event streams, and multi-region setups. Two separate CVEs target it in this release.
CVE-2026-6638 is SQL injection in ALTER SUBSCRIPTION ... REFRESH PUBLICATION. A subscriber table creator can execute arbitrary SQL with the publication-side credentials. If you are using native logical replication, Debezium, or pglogical, this affects the replication management flow directly.
CVE-2026-6476 hits pg_createsubscriber: an attacker with pg_create_subscription rights can execute SQL as a superuser. That is a significant privilege escalation from a role that sounds innocuous on its surface.
Logical replication is increasingly common precisely because it makes hard things easier. These two CVEs are a reminder that the abstraction layer is not security-free.
The Subtle One: A Timing Attack on MD5 Passwords
CVE-2026-6478 is a covert timing channel in PostgreSQL’s MD5 password comparison. By measuring tiny differences in response time, an attacker can recover valid credentials — without ever triggering a failed login. No brute force, no lockout, no alert.
The important caveat: this does not affect scram-sha-256 passwords, which have been the default since PostgreSQL 14. If you have been running PostgreSQL 14 or higher from the start, you are likely safe. But if your database was upgraded from PostgreSQL 13 or earlier, you may still have MD5-hashed passwords in pg_authid.
Check with SHOW password_encryption;. If it returns md5, patching alone is not enough — reset affected user passwords to force re-hashing with scram-sha-256.
The Backup Trap: Symlink Following in pg_basebackup
CVE-2026-6475 affects pg_basebackup (plain format) and pg_rewind. A superuser on the origin database server can plant symlinks that overwrite arbitrary local files on the target — for example, /var/lib/postgres/.bashrc — to hijack the OS account during or after a backup or failover operation.
The attack window is specific: it requires files to be moved between hosts before the server restarts. That is a common pattern in VM migrations, cloud snapshot transfers, and streaming HA failover. Patch before running any backup-and-restore or failover operations in multi-host environments.
How to Apply the Patch
For minor version updates, the process is straightforward:
# Stop the service
sudo systemctl stop postgresql
# Update the binaries (Debian/Ubuntu)
sudo apt-get update && sudo apt-get install postgresql-18
# Start it back up
sudo systemctl start postgresql
# Confirm the version
psql -c "SELECT version();"No dump, no pg_upgrade, no schema migration. The patch is cumulative — if you skipped 18.1 through 18.3, this brings you current in one step. If you skipped multiple update releases, check the release notes for any additional post-update steps specific to your version gap.
One More Thing: PostgreSQL 14 Reaches EOL in November
Version 14.23 — part of this release batch — is the last patch PostgreSQL 14 will ever receive. End of life is November 12, 2026. After that date, security vulnerabilities disclosed against version 14 will not receive patches from the PostgreSQL Global Development Group.
If you are on PostgreSQL 14, apply 14.23 now. Then plan your upgrade to 15, 16, 17, or 18 before November. You have months to test it properly — use them. The alternative is scrambling under incident pressure after a post-EOL CVE drops with no fix available.
Bottom Line
PostgreSQL now runs in over 55% of developer environments globally. A CVSS 8.8 with a path from unprivileged database user to OS shell is not an abstract risk — it is a real exposure in production systems that most of the industry depends on. The patch is a binary swap and a restart. There is no good reason to delay this one.
