EDB Security

Suggest edits

EDB is committed to a security first approach, from the products we build and the platforms we operate, to the services we provide our customers. Transparency is a core principle for the program and part of this effort includes welcoming incoming reports so that we can address concerns surfaced by our customers or security researchers. You’ll also find it in our advisories, which detail issues found and the required fixes or mitigations needed to keep your data and databases safe.

Policies

  • EDB Vulnerability Disclosure Policy

    This policy outlines how EnterpriseDB handles disclosures related to suspected vulnerabilities within our products, systems, or services. It also provides guidance for those who wish to perform security research, or may have discovered a potential security vulnerability impacting EDB.

Advisories

PostgreSQL CVE Assessments

Most Recent Advisories

CVE-2026-0949

  Read Advisory  Updated: 2026/01/16

PEM 9.8 Cross-site scripting

Postgres Enterprise Manager (PEM)
Summary:  PEM versions prior to 9.8.1 are affected by a stored Cross-Site Scripting (XSS) vulnerability that allows users with access to the “Manage Charts” menu to inject arbitrary Javascript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the “Manage Charts” menu.
Read More...

CVE-2025-2506

  Read Advisory  Published: 2025/05/22

pglogical 3.x, BDR/PGD 4.x and BDR/PGD 5.x allow unauthorized reads

All versions of pglogical 3.x, BDR/PGD 4.x and BDR/PGD 5.x prior to 3.7.26-ELS, 4.3.8-ELS and 5.8.0
Summary:  When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5.
Read More...

CVE-2025-14038

  Read Advisory  Updated: 2025/12/15

Unauthenticated gRPC API Access

Hybrid Manager (HM)
Summary:  EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This allows unauthorized access to critical internal gRPC APIs within a Hybrid Manager service due to missing authentication and authorization checks in the Istio Gateway configuration. This vulnerability has been remediated in EDB Hybrid Manager 1.3.3 and HM 2025.12, and customers should consider upgrading to the patched version as soon as possible.
Read More...

CVE-2024-4545

  Read Advisory  Updated: 2024/05/09

EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr

All versions of EDB Postgres Advanced Server (EPAS) edbldr from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0
Summary:  All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 and prior to 15.7.0 and from 16.0 and prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files to which they would not otherwise have access.
Read More...

CVE-2023-41120

  Read Advisory  Updated: 2025/01/31

EDB Postgres Advanced Server (EPAS) DBMS_PROFILER data may be removed without permission

All versions of EnterpriseDB Postgres Advanced Server (EPAS) prior to 11.21.32, 12.16.20, 13.12.17, 14.9.0, 15.4.0
Summary:  An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions.
Read More...

Most Recent Assessments

CVE-2026-3172

  Read Assessment  Published: 2026/03/10

pgvector buffer overflow in parallel HNSW index build

EDB Postgres Extended Server, EDB Postgres Advanced Server, EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, WarehousePG, pgvector versions 0.6.0-0.8.1, aidb, pgpu
Summary:  A buffer overflow in the parallel HNSW (Hierarchical Navigable Small World) index build process in the pgvector extension allows an authenticated database user to issue crafted queries that achieve a buffer overrun. This can lead to the leaking of sensitive data from other relations or a crash of the database server. The vulnerability is specifically triggered during concurrent index construction when multiple worker processes are utilized.
Read More...

CVE-2026-2007

  Read Assessment  Published: 2026/02/12

PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

Postgresql 18.0 and 18.1, EDB Postgres Extended Server prior to 18.2.0, EDB Postgres Advanced Server prior to 18.2.0
Summary:  Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. Specifically affecting the pg_trgm extension, the vulnerability arises when crafted input causes an overflow, potentially leading to denial of service or privilege escalation.
Read More...

CVE-2026-2006

  Read Assessment  Published: 2026/02/12

PostgreSQL missing validation of multibyte character length executes arbitrary code

All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary:  Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. This can lead to arbitrary code execution as the operating system user running the database.
Read More...

CVE-2026-2005

  Read Assessment  Published: 2026/02/12

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary:  Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Insufficient validation of ciphertext length and structure before copying decrypted data into heap-allocated buffers leads to memory corruption.
Read More...

CVE-2026-2004

  Read Assessment  Published: 2026/02/12

PostgreSQL intarray extension selectivity estimator executes arbitrary code

All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary:  Improper validation of input types in the PostgreSQL intarray extension allows an object creator to execute arbitrary code as the operating system user running the database server. An authenticated user with object creation privileges can bypass type validation checks in the selectivity estimator function to compromise the underlying host.
Read More...

Could this page be better? Report a problem or suggest an addition!