Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-41558: PostgreSQL set_user Extension Bypass via Misconfigured Settings

CVE-2021-41558 · published 5 years ago

Summary

An outdated version of the set_user extension for PostgreSQL can be exploited if an attacker is allowed to change database settings. This could potentially allow them to execute unauthorized commands. Update to the latest version of the set_user extension to address this issue.

What to do

Update set_user_project set_user to version 3.0.0 or later.

Affected software

Vendor	Product	Affected versions
set_user_project	set_user	< 3.0.0 `cpe:2.3:a:set_user_project:set_user::::::postgresql::*`

Original advisory text

The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config.

References

https://github.com/pgaudit/set_user/releases/tag/REL3_0_0 Release Notes Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Timeline

Published27 Sep 2021

Updated31 Oct 2026

First seen9 Jul 2026

Sources

CVE-2021-41558 · OSV

CVE-2021-41558 · NVD

Track software like this

Free during beta