CVE-2026-6460

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 0.59%
EPSS Percentile: 48.79%
CISA KEV: Not listed

Description

Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Published: 12-Nov-2026 22:17
Last Modified: 13-Nov-2026 12:18
EPSS Date: 2026-11-13
CWE: CWE-843

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

n/a · PostgreSQL Source: CNA · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Default status: unaffected

18 ≤ version < 18.7 — affected (rpm)
17 ≤ version < 17.12 — affected (rpm)
16 ≤ version < 16.16 — affected (rpm)
15 ≤ version < 15.20 — affected (rpm)
0 ≤ version < 14.25 — affected (rpm)

References

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Last enrichment sync: 14-Nov-2026 03:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The flaw, tracked as CVE-2026-6460, has a CVSS score of 8.8. Any code run this way has the rights of the operating system user that runs PostgreSQL. All versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. PostgreSQL Fixes 52 Flaws, Including Type-Confusion Bug That Can Enable Code Execution

CVE (1)

People (1)

Vendors (7)

Products (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.