{"api_version":"1","generated_at":"2026-11-12T23:54:16+00:00","cve":"CVE-2026-14661","urls":{"html":"https://cve.report/CVE-2026-14661","api":"https://cve.report/api/cve/CVE-2026-14661.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-14661","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-14661"},"summary":{"title":"PostgreSQL dblink and subscriptions can append to arbitrary files","description":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.  Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.  This \"sslkeylogfile\" mechanism cannot add arbitrary bytes.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.","state":"PUBLISHED","assigner":"PostgreSQL","published_at":"2026-11-12 15:17:49","updated_at":"2026-11-12 22:19:21"},"problem_types":["CWE-73","CWE-73 External Control of File Name or Path"],"metrics":[{"version":"3.1","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-14661/","name":"https://www.postgresql.org/support/security/CVE-2026-14661/","refsource":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14661","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14661","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 18 18.7 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 17 17.12 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 16 16.16 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 15 15.20 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 14.25 rpm","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Revoke public EXECUTE permission on dblink functions","time":"","lang":"en"},{"source":"CNA","title":"","value":"Revoke pg_create_subscription from any roles that do not already have pg_write_server_files privileges","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-14661","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:10:28.300290Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-12T21:42:18.453Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"configurations":[{"lang":"en","value":"Superuser previously issued \"CREATE EXTENSION dblink\"."},{"lang":"en","value":"Superuser previously granted pg_create_subscription to non-superuser roles."}],"credits":[{"lang":"en","value":"The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem."}],"descriptions":[{"lang":"en","value":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.  Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.  This \"sslkeylogfile\" mechanism cannot add arbitrary bytes.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-73","description":"External Control of File Name or Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T14:15:30.140Z","orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","shortName":"PostgreSQL"},"references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-14661/"}],"title":"PostgreSQL dblink and subscriptions can append to arbitrary files","workarounds":[{"lang":"en","value":"Revoke public EXECUTE permission on dblink functions"},{"lang":"en","value":"Revoke pg_create_subscription from any roles that do not already have pg_write_server_files privileges"}],"x_postgresql":{"component":"contrib module"}}},"cveMetadata":{"assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","assignerShortName":"PostgreSQL","cveId":"CVE-2026-14661","datePublished":"2026-11-12T14:15:30.140Z","dateReserved":"2026-07-03T20:28:07.149Z","dateUpdated":"2026-11-12T21:42:18.453Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 15:17:49","lastModifiedDate":"2026-11-12 22:19:21","problem_types":["CWE-73","CWE-73 External Control of File Name or Path"],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-12T21:10:28.300290Z","id":"CVE-2026-14661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"14661","Ordinal":"1","Title":"PostgreSQL dblink and subscriptions can append to arbitrary file","CVE":"CVE-2026-14661","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"14661","Ordinal":"1","NoteData":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.  Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.  This \"sslkeylogfile\" mechanism cannot add arbitrary bytes.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.","Type":"Description","Title":"PostgreSQL dblink and subscriptions can append to arbitrary file"}]}}}