CVE-2026-15741

A SQL injection flaw in PostgreSQL's EXTRACT() expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pg_dump or psql inspect or export the object.

An Important-rated SQL injection vulnerability in PostgreSQL's EXTRACT() expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By crafting a hostile database object, an attacker can trigger privilege escalation when administrative tools like pg_dump or psql process the object. This poses a significant risk to environments where non-administrative users are granted object creation rights.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, administrators should strictly limit database object creation privileges to highly trusted users. When performing backups or database introspection using pg_dump or psql, exercise caution when operating on databases that allow untrusted users to define objects,