CVE-2026-18408

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pg_dump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim processes this manipulated dump, the injected code executes with the privileges of the operating system account running the psql client.

An Important-rated vulnerability in PostgreSQL allows a malicious superuser on an origin server to compromise client systems during a database restore. By injecting arbitrary code into a database dump, the attacker can trigger execution when the file is processed by a victim's psql client. This runs the malicious code with the operating system privileges of the user performing the restore, effectively escalating access from the compromised database server to the client machine.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, administrators should avoid generating or restoring pg_dump files from untrusted or public origin servers using the psql client. If restoring a plain-format dump from an unverified source is strictly necessary, manually inspect the file for unauthorized \restrict or \unrestrict meta-commands before execution, or isolate the restore process in a sandboxed environment