Search
Find a vulnerability
Search criteria
2 vulnerabilities found for babelfish-for-postgresql by AWS
CVE-2026-119922 (GCVE-0-2026-119922)
Vulnerability from nvd – Published: 2026-11-03 18:08 – Updated: 2026-11-03 20:13
VLAI
EPSS
VEX
Title
Babelfish for PostgreSQL Privilege Escalation
Summary
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 20:13 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/babelfish-for-postgresql/babel… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | babelfish-for-postgresql |
Affected:
1.2 , ≤ 1.5
(custom)
Affected: 2.1 , ≤ 2.15 (custom) Affected: 3.1 , ≤ 3.12 (custom) Affected: 4.0 , ≤ 4.8 (custom) Affected: 5.1 , ≤ 5.4 (custom) cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T20:13:35.320527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:13:48.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "babelfish-for-postgresql",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "1.5",
"status": "affected",
"version": "1.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.15",
"status": "affected",
"version": "2.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.12",
"status": "affected",
"version": "3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.8",
"status": "affected",
"version": "4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.5",
"versionStartIncluding": "1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.15",
"versionStartIncluding": "2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.12",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.8",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\u003c/p\u003e"
}
],
"value": "Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:19:55.504Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-165-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Babelfish for PostgreSQL Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-119922",
"datePublished": "2026-11-03T18:08:48.966Z",
"dateReserved": "2026-10-30T16:59:28.086Z",
"dateUpdated": "2026-11-03T20:13:48.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119922 (GCVE-0-2026-119922)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:08 – Updated: 2026-11-03 20:13
VLAI
EPSS
VEX
Title
Babelfish for PostgreSQL Privilege Escalation
Summary
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 20:13 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/babelfish-for-postgresql/babel… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | babelfish-for-postgresql |
Affected:
1.2 , ≤ 1.5
(custom)
Affected: 2.1 , ≤ 2.15 (custom) Affected: 3.1 , ≤ 3.12 (custom) Affected: 4.0 , ≤ 4.8 (custom) Affected: 5.1 , ≤ 5.4 (custom) cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T20:13:35.320527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:13:48.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "babelfish-for-postgresql",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "1.5",
"status": "affected",
"version": "1.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.15",
"status": "affected",
"version": "2.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.12",
"status": "affected",
"version": "3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.8",
"status": "affected",
"version": "4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.5",
"versionStartIncluding": "1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.15",
"versionStartIncluding": "2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.12",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.8",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\u003c/p\u003e"
}
],
"value": "Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:19:55.504Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-165-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Babelfish for PostgreSQL Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-119922",
"datePublished": "2026-11-03T18:08:48.966Z",
"dateReserved": "2026-10-30T16:59:28.086Z",
"dateUpdated": "2026-11-03T20:13:48.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}