CVE-2026-116335

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116335", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-26T04:01:48.586Z", "datePublished": "2026-11-12T14:15:19.796Z", "dateUpdated": "2026-11-13T05:02:53.309Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:19.796Z"}, "title": "PostgreSQL commutator or negator result-type confusion executes arbitrary code", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-843", "type": "CWE", "description": "Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-116335/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-116335"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T05:02:53.309Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "id": "CVE-2026-116335", "lastModified": "2026-11-13T05:18:07.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116335", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-11-12T15:17:42.043", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-116335/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: PostgreSQL: Arbitrary code execution via operator link type confusion", "id": "2572570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572570"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in PostgreSQL. An authenticated database user with permissions to create database objects can trigger a type confusion issue by creating operator commutator or negator links with mismatched result types or inconsistent reciprocal links. Successful exploitation allows an attacker to execute arbitrary code on the host system with the privileges of the operating system user running the database server."], "mitigation": {"lang": "en:us", "value": "Restrict access to the PostgreSQL service to trusted hosts and revoke schema creation privileges from untrusted database users.\n1. Restrict PostgreSQL network reachability using firewalld:\nfirewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --reload\nAlternatively, restrict client addresses in pg_hba.conf and reload the service:\nsystemctl reload postgresql\n2. Revoke object creation permissions on database schemas to prevent unprivileged users from defining operators:\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nCaveats: Revoking schema creation privileges prevents non-administrative database users from defining new objects, which may break applications that create custom or temporary entities. Restricting network access prevents external connections from non-allowlisted systems.\nWarning: Reloading firewall rules or reloading the PostgreSQL service via `systemctl reload postgresql` applies configuration changes immediately. Ensure that changes to pg_hba.conf are validated prior to reloading to avoid service disruptions."}, "name": "CVE-2026-116335", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116335\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116335\nhttps://www.postgresql.org/support/security/CVE-2026-116335/"], "statement": "This flaw is rated as Important severity rather than Critical because exploitation requires valid database credentials with schema-creation privileges, although arbitrary code execution under the database daemon presents a severe host and data risk. In standard Red Hat Enterprise Linux environments, the database server runs under a dedicated service account, but successful exploitation permits full compromise of all managed databases and local files accessible to the service. Deployments are primarily exposed when untrusted accounts possess permissions to define custom database objects.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.25)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-12T23:30:10.626745+00:00", "updated": "2026-11-13T05:45:15.824286+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}