PostgreSQL Fixes 52 Flaws, Including Type-Confusion Bug That Can Enable Code Execution
Summary
PostgreSQL fixed 52 flaws, including CVE-2026-6460, a type-confusion bug that can let a user able to create objects run code as the PostgreSQL OS user. Exploitation has not been reported; affected versions require updates and extension rebuilds.
Key points
- CVE-2026-6460 affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.
- The type-confusion flaw can let a database user with object-creation ability execute code with the privileges of the operating-system account running PostgreSQL.
- Full protection requires rebuilding installed C-language extensions as well as updating PostgreSQL.
- Researcher Mehmet Ince demonstrated a crash and memory-address leak on PostgreSQL 18.6; his writeup does not include the final command-execution step.
- The project has not reported attacks using CVE-2026-6460, and the CVE record lists exploitation as none.
- The release fixes 52 flaws; one, CVE-2026-116322, lets an unauthenticated client trigger a restart of PostgreSQL 18 servers.
- Client-tool fixes include code execution through pg_restore and through a restore script in pg_dump tar output.
Article Details
- Vulnerability Types
- Type confusion
- Authenticated remote code execution
- Unauthenticated denial of service through server restart
- Code execution through a crafted archive processed by pg_restore
- Code execution through a restore script from a compromised source server
- Severity
- CVSS 8.8
- Affected Versions
- PostgreSQL versions before 18.7
- PostgreSQL versions before 17.12
- PostgreSQL versions before 16.16
- PostgreSQL versions before 15.20
- PostgreSQL versions before 14.25
- Exploitation Status
- not_reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Rebuild installed C-language extensions for full protection from CVE-2026-6460.
CVE
CVE-2026-116322Vendor / Product unavailableindex, only one flaw in the server requires neither a login nor any user action. That flaw, CVE-2026-116322, lets an unauthenticated client trigger a restart of PostgreSQL 18 servers.CVE-2026-6460Vendor / Product unavailableThe flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8. Any code run this way has the rights of the operating system user that runs PostgreSQL. All versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
People
Vendors
Amazon Web Servicesshared proofs of concept with their security teams in August. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. TheDatabrickshe worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service's current patch status.Googleteams in August. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service's current patchMicrosoftconcept with their security teams in August. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give eachRed HatRed Hat, which ships PostgreSQL packages, says in its CVE assessment that an attacker needs a database login with the ability to create or modify objects. None of these sources says whether an account with only defaultSupabaseproviders he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service's current patch status.Ubicloudinclude AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service's current patch status.
Products
AlloyDBAugust. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service's current patch status.Aurorashared proofs of concept with their security teams in August. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeupAzure PostgreSQLsecurity teams in August. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service'spg_dumpSeveral other fixes are in client tools. A crafted archive can make pg_restore run code as the user running it. A compromised source server can make psql run code through the restore script in pg_dump's tar output.pg_restoreSeveral other fixes are in client tools. A crafted archive can make pg_restore run code as the user running it. A compromised source server can make psql run code through the restore script in pg_dump's tar output.PostgreSQLA type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requiresPSQLSeveral other fixes are in client tools. A crafted archive can make pg_restore run code as the user running it. A compromised source server can make psql run code through the restore script in pg_dump's tar output.RDSof concept with their security teams in August. The providers he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does notSupabaseproviders he worked with include AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup does not give each service's current patch status.