Search
Find a vulnerability
Search criteria
222 vulnerabilities
CVE-2026-6467 (GCVE-0-2026-6467)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL extension script schema mishandling executes arbitrary SQL
Summary
Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6467",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:33.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has database-level CREATE privilege"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Noah Misch for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker\u0027s choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:32.994Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-6467/"
}
],
"title": "PostgreSQL extension script schema mishandling executes arbitrary SQL",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-6467",
"datePublished": "2026-11-12T14:15:32.994Z",
"dateReserved": "2026-04-17T00:20:56.212Z",
"dateUpdated": "2026-11-13T05:02:33.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6460 (GCVE-0-2026-6460)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code
Summary
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:34.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Andrew Gierth, Alexander Lakhin, Francesco Verardi, Hcamael, Tomer Fichman, OpenAI Security Research Team, Mehmet Ince @mdisec, Bryan Green, Sumedh Pathak, Nicholas Carlini, Sergey Shinderuk, Yuxiao Guo, Nikhil Sontakke, Stephan Lipp, and Daniel Bakker for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:32.415Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-6460/"
}
],
"title": "PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-6460",
"datePublished": "2026-11-12T14:15:32.415Z",
"dateReserved": "2026-04-17T00:15:46.725Z",
"dateUpdated": "2026-11-13T05:02:34.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18447 (GCVE-0-2026-18447)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL output parameter type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:36.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:31.850Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-18447/"
}
],
"title": "PostgreSQL output parameter type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-18447",
"datePublished": "2026-11-12T14:15:31.850Z",
"dateReserved": "2026-07-31T02:56:08.443Z",
"dateUpdated": "2026-11-13T05:02:36.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16240 (GCVE-0-2026-16240)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:41
VLAI
EPSS
VEX
Title
PostgreSQL pg_basebackup can use backup manifest content as a format string
Summary
Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:07.723348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:41:47.325Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has compromised the server being backed up; attacker has a separate way to retrieve the improperly-read bytes from the host running pg_basebackup; victim runs a backup without starting the server from that backup"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Eisentraut for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker\u0027s server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:31.280Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16240/"
}
],
"title": "PostgreSQL pg_basebackup can use backup manifest content as a format string",
"x_postgresql": {
"component": "client"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-16240",
"datePublished": "2026-11-12T14:15:31.280Z",
"dateReserved": "2026-07-20T01:55:33.940Z",
"dateUpdated": "2026-11-12T21:41:47.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16237 (GCVE-0-2026-16237)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:42
VLAI
EPSS
VEX
Title
PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition
Summary
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:19.107281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:42:02.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has INSERT and UPDATE privileges on an auto-updatable view but lacks one of those on its base table"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view\u0027s base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view\u0027s WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:30.710Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16237/"
}
],
"title": "PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-16237",
"datePublished": "2026-11-12T14:15:30.710Z",
"dateReserved": "2026-07-20T01:55:06.428Z",
"dateUpdated": "2026-11-12T21:42:02.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14661 (GCVE-0-2026-14661)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:42
VLAI
EPSS
VEX
Title
PostgreSQL dblink and subscriptions can append to arbitrary files
Summary
External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:28.300290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:42:18.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION dblink\"."
},
{
"lang": "en",
"value": "Superuser previously granted pg_create_subscription to non-superuser roles."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user\u0027s choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:30.140Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14661/"
}
],
"title": "PostgreSQL dblink and subscriptions can append to arbitrary files",
"workarounds": [
{
"lang": "en",
"value": "Revoke public EXECUTE permission on dblink functions"
},
{
"lang": "en",
"value": "Revoke pg_create_subscription from any roles that do not already have pg_write_server_files privileges"
}
],
"x_postgresql": {
"component": "contrib module"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14661",
"datePublished": "2026-11-12T14:15:30.140Z",
"dateReserved": "2026-07-03T20:28:07.149Z",
"dateUpdated": "2026-11-12T21:42:18.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120154 (GCVE-0-2026-120154)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:42
VLAI
EPSS
VEX
Title
PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
Summary
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:35.332140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:42:35.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has INSERT, UPDATE, and applicable SELECT privileges on a table with a row security policy"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, Nicholas Carlini, Joao Detomini, Josef \u0160im\u00e1nek, and Qing Xu for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:29.579Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120154/"
}
],
"title": "PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120154",
"datePublished": "2026-11-12T14:15:29.579Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-12T21:42:35.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120153 (GCVE-0-2026-120153)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL extension-script substitutions allow SQL injection through object names
Summary
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:37.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has database-level CREATE privilege, and administrator has installed the files of a vulnerable non-bundled extension"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program, Sven Klemm, and Aaron chen for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:29.010Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120153/"
}
],
"title": "PostgreSQL extension-script substitutions allow SQL injection through object names",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120153",
"datePublished": "2026-11-12T14:15:29.010Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-13T05:02:37.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120152 (GCVE-0-2026-120152)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:43
VLAI
EPSS
VEX
Title
PostgreSQL pg_show_all_settings() use-after-free discloses memory
Summary
Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:11 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:11:31.172233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:43:08.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:28.444Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120152/"
}
],
"title": "PostgreSQL pg_show_all_settings() use-after-free discloses memory",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120152",
"datePublished": "2026-11-12T14:15:28.444Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-12T21:43:08.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120151 (GCVE-0-2026-120151)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL plpgsql record-field type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:40.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable\u0027s row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:27.877Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120151/"
}
],
"title": "PostgreSQL plpgsql record-field type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120151",
"datePublished": "2026-11-12T14:15:27.877Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-13T05:02:40.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120150 (GCVE-0-2026-120150)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL expanded-record domain-check use-after-free executes arbitrary code
Summary
Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:40.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:27.323Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120150/"
}
],
"title": "PostgreSQL expanded-record domain-check use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120150",
"datePublished": "2026-11-12T14:15:27.323Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:40.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120149 (GCVE-0-2026-120149)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL FDW batch-insert mismatch executes arbitrary code
Summary
Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:44.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION postgres_fdw\"; attacker has local permission to create objects (temporary objects or non-temporary objects in at least one schema); attacker has remote-server permission to create non-temporary objects in at least one schema."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Sumedh Pathak and Sven Klemm for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:26.749Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120149/"
}
],
"title": "PostgreSQL FDW batch-insert mismatch executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120149",
"datePublished": "2026-11-12T14:15:26.749Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:44.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120148 (GCVE-0-2026-120148)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120148",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:42.566Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:25.724Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120148/"
}
],
"title": "PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120148",
"datePublished": "2026-11-12T14:15:25.724Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:42.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120147 (GCVE-0-2026-120147)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code
Summary
Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120147",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:41.249Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION dblink\". Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks \uc548\uc9c0\uc6a9 for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:25.141Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120147/"
}
],
"title": "PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code",
"x_postgresql": {
"component": "contrib module"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120147",
"datePublished": "2026-11-12T14:15:25.141Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:41.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120146 (GCVE-0-2026-120146)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15
VLAI
EPSS
VEX
Title
PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks
Summary
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "a role grant to the attacker has INHERIT TRUE and SET FALSE, or the attacker could run ALTER DATABASE ... OWNER but for lack of CREATEDB privilege"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zsolt Parragi for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:24.583Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120146/"
}
],
"title": "PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120146",
"datePublished": "2026-11-12T14:15:24.583Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-12T14:15:24.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120145 (GCVE-0-2026-120145)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code
Summary
Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:46.001Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "victim has created a superuser-owned subscription to an attacker-controlled publisher"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks qian zhang for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:23.991Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120145/"
}
],
"title": "PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120145",
"datePublished": "2026-11-12T14:15:23.991Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:46.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120144 (GCVE-0-2026-120144)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL type-cache invalidation gap executes arbitrary code
Summary
Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120144",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:41.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:23.436Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120144/"
}
],
"title": "PostgreSQL type-cache invalidation gap executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120144",
"datePublished": "2026-11-12T14:15:23.436Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-13T05:02:41.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120143 (GCVE-0-2026-120143)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL transition-table cursor use-after-free executes arbitrary code
Summary
Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:43.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:22.843Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120143/"
}
],
"title": "PostgreSQL transition-table cursor use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120143",
"datePublished": "2026-11-12T14:15:22.843Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-13T05:02:43.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120142 (GCVE-0-2026-120142)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL dropped-column type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120142",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:45.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:22.150Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120142/"
}
],
"title": "PostgreSQL dropped-column type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120142",
"datePublished": "2026-11-12T14:15:22.150Z",
"dateReserved": "2026-10-30T22:45:08.382Z",
"dateUpdated": "2026-11-13T05:02:45.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120141 (GCVE-0-2026-120141)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL materialized set-returning function type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:47.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:21.515Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120141/"
}
],
"title": "PostgreSQL materialized set-returning function type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120141",
"datePublished": "2026-11-12T14:15:21.515Z",
"dateReserved": "2026-10-30T22:45:08.382Z",
"dateUpdated": "2026-11-13T05:02:47.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120139 (GCVE-0-2026-120139)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL tuple-size integer wraparound executes arbitrary code
Summary
Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:49.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Hillai Ben Sasson, Jayden Sarveshkumar, and Mehmet Ince for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:20.956Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120139/"
}
],
"title": "PostgreSQL tuple-size integer wraparound executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120139",
"datePublished": "2026-11-12T14:15:20.956Z",
"dateReserved": "2026-10-30T22:45:08.382Z",
"dateUpdated": "2026-11-13T05:02:49.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116336 (GCVE-0-2026-116336)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions
Summary
Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116336",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:51.006Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Florent Saudel for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:20.347Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116336/"
}
],
"title": "PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116336",
"datePublished": "2026-11-12T14:15:20.347Z",
"dateReserved": "2026-10-26T04:01:48.586Z",
"dateUpdated": "2026-11-13T05:02:51.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116335 (GCVE-0-2026-116335)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL commutator or negator result-type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:53.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:19.796Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116335/"
}
],
"title": "PostgreSQL commutator or negator result-type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116335",
"datePublished": "2026-11-12T14:15:19.796Z",
"dateReserved": "2026-10-26T04:01:48.586Z",
"dateUpdated": "2026-11-13T05:02:53.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116333 (GCVE-0-2026-116333)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:45
VLAI
EPSS
VEX
Title
PostgreSQL parallel B-tree array scan reads beyond array bounds
Summary
Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:19 UTC
CWE
- CWE-126 - Buffer Over-read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116333",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:19:33.982665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:45:33.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:19.133Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116333/"
}
],
"title": "PostgreSQL parallel B-tree array scan reads beyond array bounds",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116333",
"datePublished": "2026-11-12T14:15:19.133Z",
"dateReserved": "2026-10-26T04:01:48.585Z",
"dateUpdated": "2026-11-12T21:45:33.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116332 (GCVE-0-2026-116332)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL portal setup use-after-free executes arbitrary code
Summary
Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116332",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:54.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Tomas Vondra for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:18.550Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116332/"
}
],
"title": "PostgreSQL portal setup use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116332",
"datePublished": "2026-11-12T14:15:18.550Z",
"dateReserved": "2026-10-26T03:52:44.054Z",
"dateUpdated": "2026-11-13T05:02:54.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116331 (GCVE-0-2026-116331)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL min/max aggregate type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116331",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:55.665Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zheng Yu for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate\u0027s input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:17.983Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116331/"
}
],
"title": "PostgreSQL min/max aggregate type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116331",
"datePublished": "2026-11-12T14:15:17.983Z",
"dateReserved": "2026-10-26T03:52:44.054Z",
"dateUpdated": "2026-11-13T05:02:55.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116330 (GCVE-0-2026-116330)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL pg_dump tar restore.sql fails to block psql command injection
Summary
Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:55.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "victim runs psql on restore.sql from a tar-format dump of an attacker-controlled origin server"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Pavel Kopylov for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:17.385Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116330/"
}
],
"title": "PostgreSQL pg_dump tar restore.sql fails to block psql command injection",
"workarounds": [
{
"lang": "en",
"value": "use pg_restore instead of running restore.sql"
}
],
"x_postgresql": {
"component": "client"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116330",
"datePublished": "2026-11-12T14:15:17.385Z",
"dateReserved": "2026-10-26T03:52:44.054Z",
"dateUpdated": "2026-11-14T04:57:55.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116329 (GCVE-0-2026-116329)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL statistics import type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:58.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:16.818Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116329/"
}
],
"title": "PostgreSQL statistics import type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116329",
"datePublished": "2026-11-12T14:15:16.818Z",
"dateReserved": "2026-10-26T03:52:44.054Z",
"dateUpdated": "2026-11-14T04:57:58.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116328 (GCVE-0-2026-116328)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL generation memory context integer wraparound executes arbitrary code
Summary
Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116328",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:59.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Jayden Sarveshkumar for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:16.239Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116328/"
}
],
"title": "PostgreSQL generation memory context integer wraparound executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116328",
"datePublished": "2026-11-12T14:15:16.239Z",
"dateReserved": "2026-10-26T03:52:44.054Z",
"dateUpdated": "2026-11-14T04:57:59.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116327 (GCVE-0-2026-116327)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 14:15
VLAI
EPSS
VEX
Title
PostgreSQL security_barrier analysis can expose hidden values through indirect expressions
Summary
Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Only see myself for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:15.661Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116327/"
}
],
"title": "PostgreSQL security_barrier analysis can expose hidden values through indirect expressions",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-116327",
"datePublished": "2026-11-12T14:15:15.661Z",
"dateReserved": "2026-10-26T03:52:44.053Z",
"dateUpdated": "2026-11-12T14:15:15.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}