EDB Security

Suggest edits

EDB is committed to a security first approach, from the products we build and the platforms we operate, to the services we provide our customers. Transparency is a core principle for the program and part of this effort includes welcoming incoming reports so that we can address concerns surfaced by our customers or security researchers. You’ll also find it in our advisories, which detail issues found and the required fixes or mitigations needed to keep your data and databases safe.

Policies

  • EDB Vulnerability Disclosure Policy

    This policy outlines how EnterpriseDB handles disclosures related to suspected vulnerabilities within our products, systems, or services. It also provides guidance for those who wish to perform security research, or may have discovered a potential security vulnerability impacting EDB.

Advisories

PostgreSQL CVE Assessments

Most Recent Advisories

CVE-2025-2506

  Read Advisory  Published: 2025/05/22

pglogical 3.x, BDR/PGD 4.x and BDR/PGD 5.x allow unauthorized reads

All versions of pglogical 3.x, BDR/PGD 4.x and BDR/PGD 5.x prior to 3.7.26-ELS, 4.3.8-ELS and 5.8.0
Summary:  When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5.
Read More...

CVE-2025-14038

  Read Advisory  Updated: 2025/15/03

Unauthenticated gRPC API Access

Hybrid Manager (HM)
Summary:  EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This allows unauthorized access to critical internal gRPC APIs within a Hybrid Manager service due to missing authentication and authorization checks in the Istio Gateway configuration. This vulnerability has been remediated in EDB Hybrid Manager 1.3.3 and HM 2025.12, and customers should consider upgrading to the patched version as soon as possible.
Read More...

CVE-2024-4545

  Read Advisory  Updated: 2024/05/09

EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr

All versions of EDB Postgres Advanced Server (EPAS) edbldr from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0
Summary:  All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files to which they would not otherwise have access.
Read More...

CVE-2023-41120

  Read Advisory  Updated: 2025/01/31

EDB Postgres Advanced Server (EPAS) DBMS_PROFILER data may be removed without permission

All versions of EnterpriseDB Postgres Advanced Server (EPAS) prior to 11.21.32, 12.16.20, 13.12.17, 14.9.0, 15.4.0
Summary:  An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions.
Read More...

CVE-2023-41119

  Read Advisory  Updated: 2025/01/31

EDB Postgres Advanced Server (EPAS) dbms_aq helper function may run arbitrary SQL as a superuser

All versions of EnterpriseDB Postgres Advanced Server (EPAS) prior to 11.21.32, 12.16.20, 13.12.17, 14.9.0, 15.4.0
Summary:  An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user's privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.
Read More...

Most Recent Assessments

CVE-2025-8715

  Read Assessment  Updated: 2025/08/14

PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

All versions of Postgresql prior to 17.6, 16.10, 15.14, 14.19, 13.22 3.x, EDB Postgres Extended Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22, EDB Postgres Advanced Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22
Summary:  Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected.
Read More...

CVE-2025-8714

  Read Assessment  Updated: 2025/08/14

PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client

All versions of Postgresql prior to 17.6, 16.10, 15.14, 14.19, 13.22 3.x, EDB Postgres Extended Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22, EDB Postgres Advanced Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22
Summary:  Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096.
Read More...

CVE-2025-46801

  Read Assessment  Updated: 2025/07/04

Pgpool-II Authentication Bypass

All versions of EDB Pool prior to 4.5.1-4, PGPool-II versions prior to 4.6.1, 4.5.7, 4.4.12, 4.3.15, and 4.2.22
Summary:  Pgpool-II contains an authentication bypass vulnerability that can be exploited under certain conditions. If an attacker exploits the vulnerability they may be able to log in to the system as an arbitrary user, which could allow them to read or tamper with data in the database, and/or disable the database.
Read More...

CVE-2025-2291

  Read Assessment  Updated: 2025/04/30

PgBouncer "VALID UNTIL yesterday"

All versions of PGBouncer prior to 1.24.1, TPA prior to 23.38.0, PGAI Cloud Service prior to May 12, 2025
Summary:  In PgBouncer, the auth_query mechanism does not consider the VALID UNTIL attribute set in PostgreSQL for user passwords. This oversight allows users to authenticate using expired passwords, potentially granting unauthorized access. The flaw was fixed in [PgBouncer 1.24.1](https://www.pgbouncer.org/changelog.html#pgbouncer-124x).
Read More...

CVE-2025-1094

  Read Assessment  Updated: 2025/02/15

PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

All versions of PostgreSQL, EPAS and PGE prior to 17.3, 16.7, 15.11, 14.16, and 13.19
Summary:  Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
Read More...

Could this page be better? Report a problem or suggest an addition!