CVE-2026-6460

PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code

Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-6467

PostgreSQL extension script schema mishandling executes arbitrary SQL

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-16237

PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-16240

PostgreSQL pg_basebackup can use backup manifest content as a format string

Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-18447

PostgreSQL output parameter type confusion executes arbitrary code

Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-14661

PostgreSQL dblink and subscriptions can append to arbitrary files

External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116308

PostgreSQL dict_int reads beyond zero-length tokens

Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116309

PostgreSQL plperl blessed-reference type confusion may execute arbitrary code

Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116311

PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-120143

PostgreSQL transition-table cursor use-after-free executes arbitrary code

Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-120147

PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code

Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-120152

PostgreSQL pg_show_all_settings() use-after-free discloses memory

Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116303

PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions

Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116304

PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code

Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116306

PostgreSQL composite-type change during field assignment executes arbitrary code

Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116307

PostgreSQL plperl prepared-query use-after-free executes arbitrary code

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116310

PostgreSQL COPY error context uses freed field storage

Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116312

PostgreSQL MERGE can place the wrong row in a trigger transition table

Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116313

PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116314

PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation

Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql