External risk intelligence

PostgreSQL Command Injection Allows Root Access on Mobile Devices

CVE advisorySeverity: MEDIUM (CVSS 6.5)

CVE-2026-49004

The vulnerability resides in a local PostgreSQL service on a mobile device. Mobile device databases are designed for local application data storage and are not intended to be exposed to or reachable from the public internet in standard deployment patterns.

SQL Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a PostgreSQL service on mobile devices. This service, running with elevated privileges and weak credentials, is susceptible to command injection. Attackers could potentially exploit this to bypass security measures and gain complete control over the device.

Flaws allow unauthorized device control.
Remember for potential local device compromise.
Confirm relevance and extent of exposure.

Attack Path

How an attacker could exploit the issue

Attackers can leverage a misconfigured PostgreSQL service running with root privileges on a mobile device. This service is accessible via a specific port and protected by weak credentials. By exploiting the database's support for `COPY FROM PROGRAM`, an attacker can bypass the Android permission sandbox, ultimately achieving full root access.

Requires access to the device's network.
Triggered via the `COPY FROM PROGRAM` database command.
Risk: Full root access, bypassing security.

Live Threat

Current exploitation, exposure, and threat context

A misconfigured PostgreSQL service running with root privileges on a mobile device could be exploited through command injection. This may allow local attackers to bypass the device's security sandbox and gain complete root access to the system when the database's COPY FROM PROGRAM syntax is supported.

System data and user data at risk.
Local attackers could bypass sandbox.
Full root access to the device.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining ownership requires identifying the specific mobile device and application that utilizes the PostgreSQL service. The first practical step is to confirm if this service is exposed externally or accessible from business-critical systems. Once identified, the accountable owner, likely within the mobile application development or platform team, should be engaged to plan remediation based on the risk of unauthorized root access.

Mobile application or platform owners.
Verify external reachability and criticality.
Plan mitigation based on access risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PostgreSQL service running on these mobile devices?

This component is an embedded database service integrated directly into the mobile device's operating environment. Unlike standard server-side databases used for enterprise backends, this instance manages local application data storage. Because it runs with root-level privileges and includes misconfigurations, it creates a bridge between standard database operations and the underlying mobile operating system's core controls.

What does CVE-2026-49004 mean for device security?

This vulnerability is classified as CWE-89, which relates to improper neutralization of special elements used in an SQL command. In this specific case, the database's feature that allows executing external programs—known as COPY FROM PROGRAM—is exposed. An attacker can use this functionality to inject unauthorized system commands, effectively bypassing the Android security sandbox to gain full administrative control.

How is the command injection triggered?

The vulnerability is triggered when an attacker sends malicious input to the database service via the network port it occupies. It requires using the COPY FROM PROGRAM command syntax to execute code. Notably, simply connecting to the port or performing standard database queries without leveraging this specific command feature does not trigger the unauthorized root access path.

Is my device at risk if it is not exposed to the internet?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the public internet in standard deployment patterns. Since the service is designed for local application data storage, the primary risk involves attackers who already have access to the device's local network. Internal-only or non-networked devices do not face the same external threat profile as those with broader connectivity.

What should I do if I manage devices running this software?

Your first step is to perform an inventory to identify which specific mobile applications or platforms utilize this PostgreSQL service. Once identified, verify whether the service is reachable from your business-critical systems or the internet. Coordinate with your application development or platform owners to review the service configuration and prioritize mitigation, focusing on restricting access to this vulnerable port.

References

support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/4601748669820…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.