CVE-2026-18408: PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

CSIRTS triage

What: A superuser on the pg_dump origin server can execute arbitrary code in the psql client via the \unrestrict command.
Who is affected: psql clients connected to PostgreSQL servers where a superuser has been compromised or is malicious.
Urgency: High severity (CVSS 8.8); immediate patching required as superuser compromise leads to direct code execution in client.
Action: Update PostgreSQL and psql to a patched version addressing CVE-2026-18408.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch psql

Get an email when a new psql advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-184080.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2026-18408	coverage & exploitation status	NVD · CVE.org

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.