CVE-2026-18447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18447", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-31T02:56:08.443Z", "datePublished": "2026-11-12T14:15:31.850Z", "dateUpdated": "2026-11-13T05:02:36.602Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:31.850Z"}, "title": "PostgreSQL output parameter type confusion executes arbitrary code", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-843", "type": "CWE", "description": "Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-18447/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-18447"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T05:02:36.602Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "id": "CVE-2026-18447", "lastModified": "2026-11-13T05:18:39.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18447", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-11-12T15:17:51.127", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-18447/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: postgresql: Arbitrary code execution via type confusion in SQL-language functions", "id": "2572532", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572532"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["A flaw was found in PostgreSQL. An authenticated database user with privileges to create database objects can trigger a type confusion flaw by defining a SQL-language function with an output parameter of type \"any\". This vulnerability allows the user to execute arbitrary code with the permissions of the operating system user running the database service."], "mitigation": {"lang": "en:us", "value": "1. Revoke CREATE privileges on public and user schemas from untrusted database roles to prevent unauthorized function creation:\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nREVOKE CREATE ON SCHEMA <schema_name> FROM <role_name>;\n2. Restrict network access to the PostgreSQL service to trusted management networks or hosts using firewalld:\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<trusted_ip_or_subnet>\" service name=\"postgresql\" accept'\nfirewall-cmd --reload\n3. Restrict database client access in /var/lib/pgsql/data/pg_hba.conf to trusted IP addresses only, then reload the database configuration:\nsystemctl reload postgresql\nCaveats:\nRevoking schema creation privileges prevents affected database users from creating or altering functions, tables, or other objects, which may disrupt applications that rely on dynamic object definitions. Restricting network access or filtering client subnets prevents connections from unlisted hosts.\nWarning:\nApplying firewall changes or configuration changes requires reloading the firewall (`firewall-cmd --reload`) or the PostgreSQL service (`systemctl reload postgresql`), which may briefly disrupt active network connections or client sessions."}, "name": "CVE-2026-18447", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-18447\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18447\nhttps://www.postgresql.org/support/security/CVE-2026-18447/"], "statement": "Red Hat rates this vulnerability as Important because an authenticated user with schema object creation privileges can escape the database engine and execute arbitrary system commands under the postgres host account. Although this issue allows compromise of the database host, exploitation requires valid database credentials and authorization to define custom functions, preventing unauthenticated remote attackers from triggering it directly. In standard Red Hat Enterprise Linux environments, untrusted database accounts are typically restricted from defining schema objects, limiting the attack surface.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.25)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-13T04:15:14.472024+00:00", "updated": "2026-11-13T04:15:14.472067+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}