Submit finding

All findings

CVE-2026-6638 low

AISLE backfill adds a PostgreSQL logical-replication injection flaw

CVE-2026-6638 allows crafted table names to inject SQL during a logical-replication REFRESH PUBLICATION operation.

Bug class
SQL injection through crafted replicated table names
Affected codebase
PostgreSQL logical replication
Credited system
AISLE
Disclosed
May 14, 2026
Attribution
Self-reported attribution
AI role
Discovery
Severity
low
Source status: PostgreSQL confirms CVE-2026-6638, rates it CVSS 3.7 low, and lists fixes in 18.4, 17.10, and 16.14. AISLE's registry supplies the AI-system attribution.

Summary

A publisher can use a crafted table name to inject SQL when a subscriber runs ALTER SUBSCRIPTION ... REFRESH PUBLICATION. PostgreSQL 18.4, 17.10, and 16.14 contain the fix.

The vendor rates the issue low at CVSS 3.7. That rating takes precedence over AISLE’s 8.8 tracker score. PostgreSQL corroborates the accepted vulnerability; AISLE provides the AI-workflow attribution.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.