CVE-2025-59468

Critical · 9.1

CVSS

9.1

EPSS

1.2%

Published

Jan 8, 2026

CISA due date

—

The record

This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter.

Affected packages

Ecosystem	Package	Introduced	Fixed