CVE-2026-14661

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14661", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-03T20:28:07.149Z", "datePublished": "2026-11-12T14:15:30.140Z", "dateUpdated": "2026-11-12T21:42:18.453Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:30.140Z"}, "title": "PostgreSQL dblink and subscriptions can append to arbitrary files", "x_postgresql": {"component": "contrib module"}, "descriptions": [{"lang": "en", "value": "External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-73", "type": "CWE", "description": "External Control of File Name or Path"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-14661/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "Superuser previously issued \"CREATE EXTENSION dblink\"."}, {"lang": "en", "value": "Superuser previously granted pg_create_subscription to non-superuser roles."}], "workarounds": [{"lang": "en", "value": "Revoke public EXECUTE permission on dblink functions"}, {"lang": "en", "value": "Revoke pg_create_subscription from any roles that do not already have pg_write_server_files privileges"}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T21:10:28.300290Z", "id": "CVE-2026-14661", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T21:42:18.453Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}], "id": "CVE-2026-14661", "lastModified": "2026-11-12T22:19:21.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14661", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T21:10:28.300290Z", "version": "2.0.3"}}]}, "published": "2026-11-12T15:17:49.890", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-14661/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: postgresql: Persistent Denial of Service via arbitrary file append in sslkeylogfile parameter", "id": "2572565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572565"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-73", "details": ["A flaw was found in PostgreSQL. An authenticated user can supply an arbitrary file path using the sslkeylogfile connection parameter in database features such as dblink or subscription management commands. By forcing the server to append cryptographic key log data to targeted system files, the user can corrupt critical files, resulting in a persistent Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-14661", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-14661\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14661\nhttps://www.postgresql.org/support/security/CVE-2026-14661/"], "statement": "Red Hat rates this vulnerability as having an Important severity because authenticated users with access to connection-string-capable database mechanisms can corrupt essential service files, resulting in a persistent and severe denial of service. Under default Red Hat Enterprise Linux deployments, SELinux policy confines the database daemon and prevents file modifications outside of PostgreSQL-managed directories, protecting core operating system components. Nonetheless, invalid TLS key logging data appended to internal database configuration files or data clusters can permanently crash the service and prevent startup, necessitating manual administrative recovery.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.25)"}}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-13T03:45:13.998162+00:00", "updated": "2026-11-13T03:45:13.998176+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}