Skip to content
Fencer Vulns
critical 9.8

CVE-2026-41889 json

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also GHSA-j88v-2chj-qfwx , GO-2026-5004 , EUVD-2026-28805

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

Patch / fix

  • go github.com/jackc/pgx/v5 5.9.2
  • jackc pgx 5.9.2
  • cosign hummingbird 1 3.1.1-0.1.hum1
  • caddy hummingbird 1 2.11.3-0.1.hum1
  • go-fdo-server hummingbird 1 1.0.1-0.2.hum1
  • go-fdo-server-owner hummingbird 1 1.0.1-0.2.hum1
  • go-fdo-server-rendezvous hummingbird 1 1.0.1-0.2.hum1
  • go-fdo-server-manufacturer hummingbird 1 1.0.1-0.2.hum1

red hat advisories RHSA-2026:25138RHSA-2026:16133RHSA-2026:15856

  • alloy SLE Module for Basesystem 15 SP7 1.17.1-150700.15.23.1
  • alloy SLES for SAP applications 16.0, SLES 16.0 1.17.0-160000.1.1

suse advisories SUSE-SU-2026:2824-1SUSE-SU-2026:22575-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • alloy openSUSE Leap 16.0 1.17.0-160000.1.1
  • alloy openSUSE Tumbleweed 1.16.1-2.1
  • steampipe openSUSE Tumbleweed 2.4.4-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21251-1openSUSE-SU-2026:10992-1openSUSE-SU-2026:10976-1

  • keda Azure Linux 3.0 2.14.1-15
  • telegraf Azure Linux 3.0 1.31.0-22

azure linux advisories AZL-86322AZL-86325

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41889 updated cvss 5.9

github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9 Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-installer-rhel9, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/azure-service-operator-rhel9, multicluster-engine/assisted-installer-agent-rhel8, +4 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel8, multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel8, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel8-operator, +3 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-api-rhel9, openshift-pipelines/pipelines-results-api-rhel8, openshift-pipelines/pipelines-results-api-rhel9, openshift-pipelines/pipelines-hub-db-migration-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel9, +1 more
    +20 more products
    Red Hat OpenShift Service Mesh 2 openshift-service-mesh/istio-rhel8-operator Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel9-operator, 3scale-amp2/3scale-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9, rhacm2/acm-search-v2-api-rhel9, rhacm2/acm-search-indexer-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 8 rhceph/grafana-rhel9 Red Hat Ceph Storage 9 rhceph/alloy-rhel10, rhceph/grafana-rhel10 Red Hat Edge Manager 1 flightctl, rhem/flightctl-api-rhel9, rhem/flightctl-api-rhel10, rhem/flightctl-worker-rhel9, rhem/flightctl-worker-rhel10, rhem/flightctl-db-setup-rhel9, +19 more Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 10 go-fdo-server, osbuild-composer Red Hat OpenShift AI (RHOAI) rhoai/odh-maas-api-rhel9, rhoai/odh-model-registry-rhel9, rhoai/odh-codeflare-operator-rhel8, rhoai/odh-codeflare-operator-rhel9, rhoai/odh-ml-pipelines-driver-rhel8, rhoai/odh-ml-pipelines-driver-rhel9, +11 more Red Hat OpenShift Container Platform 4 openshift4/ose-installer-rhel9, openshift4/oc-mirror-plugin-rhel9, openshift4/azure-service-rhel9-operator, openshift4/ose-baremetal-installer-rhel9, openshift4/o-cloud-manager-rhel9-operator, openshift4/o-cloud-manager-operator-bundle, +10 more Red Hat Openshift Data Foundation 4 odf4/odf-cloudnative-pg-rhel9-operator Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9, quay/clair-rhel8, quay/clair-rhel9, quay/quay-operator-rhel8, quay/quay-operator-rhel9 Red Hat Trusted Artifact Signer rhtas/cosign-rhel9, rhtas/createtree-rhel9, rhtas/updatetree-rhel9, rhtas/trillian-database-rhel9, rhtas/trillian-logserver-rhel9, rhtas/trillian-logsigner-rhel9, +1 more Red Hat Zero Trust Workload Identity Manager zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9 Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9, zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9, zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1785413210
    fixed: vendor fix RHSA-2026:48872
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1785420959
    fixed: vendor fix RHSA-2026:48913
  • Red Hat Hardened Images caddy 2.11.3-0.1.hum1, cosign 3.1.1-0.1.hum1, go-fdo-server 1.0.1-0.2.hum1, go-fdo-server-owner 1.0.1-0.2.hum1, go-fdo-server-rendezvous 1.0.1-0.2.hum1, go-fdo-server-manufacturer 1.0.1-0.2.hum1
    fixed: vendor fix RHSA-2026:16133
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-roxctl-rhel8 1785413210, advanced-cluster-security/rhacs-scanner-rhel8 1784788409, advanced-cluster-security/rhacs-rhel8-operator 1785413210, advanced-cluster-security/rhacs-collector-rhel8 1784283534, advanced-cluster-security/rhacs-operator-bundle 1785413210, advanced-cluster-security/rhacs-central-db-rhel8 1785413210, +5 more Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-fact-rhel8 1784294375, advanced-cluster-security/rhacs-roxctl-rhel8 1785420959, advanced-cluster-security/rhacs-scanner-rhel8 1784785682, advanced-cluster-security/rhacs-rhel8-operator 1785420959, advanced-cluster-security/rhacs-collector-rhel8 1784282883, advanced-cluster-security/rhacs-operator-bundle 1785420959, +6 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/jackc/pgx/v5
<5.9.2
5.9.2
go github.com/jackc/pgx/v4
<=4.18.3
all versions
 no fix listed
go github.com/jackc/pgx
<=3.6.2
all versions
 no fix listed

Affected products

  • jackc pgx

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.