Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-14 | 1 | Disclosure1 |
| 2026-05-21 | 1 | General1 |
⚠️ Vulnerabilidades en productos PostgreSQL ❗ CVE-2026-6477 ❗ CVE-2026-6475 ❗ CVE-2026-6473 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-postgresql-2/ https://t.co/yHbC0kfr1p
Post summary
The tweet lists three PostgreSQL CVEs and directs readers to external links for more information, but contains no PoC, exploit, or patch details.
⚠️ HIGH — CVE-2026-6475 Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite loc… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6475 #PostgreSQL #CyberSecurity #InfoSec
Post summary
The tweet announces CVE-2026-6475, describing a symlink following flaw in PostgreSQL's backup tools, mentions its high CVSS score, and provides a link to a detailed analysis.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | postgresql | postgresql | - | - | - |