A sort confusion flaw in PostgreSQL lets a database person who can create objects run code on the server. Updates launched yesterday repair it, together with 51 different safety flaws. Full safety from this flaw additionally requires rebuilding any C-language extensions put in on the server.
The flaw, tracked as CVE-2026-6460, has a CVSS rating of 8.8. Any code run this fashion has the rights of the working system person that runs PostgreSQL. All variations earlier than 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
The PostgreSQL International Improvement Group, which publishes the database’s releases, has not reported any assaults utilizing the flaw. CISA’s evaluation within the CVE file additionally lists exploitation as none.
The flaw entails composite sorts, that are sorts constructed from named fields, every with its personal knowledge sort. A discipline’s sort may be modified whereas older values of that sort are nonetheless held in different components of the server.
The server might then learn an outdated worth as if it had the brand new sort. The repair, described within the mission’s launch notes, provides model checks so the server can detect a price that not matches its sort.
Safety researcher Mehmet Ince described a working exploit for the flaw, demonstrated on PostgreSQL 18.6, in a technical writeup revealed this week.
His technique is to organize a question that holds a price, change the kind of one of many worth’s fields, after which run the question. The writeup consists of the SQL that crashes an unpatched server this fashion and a second step that leaks reminiscence addresses. It doesn’t embrace the SQL for the ultimate step, which makes the server run a command.
He wrote that he might “set off this crash as a lowest-privileged login position.” The mission’s safety advisory describes the attacker solely as somebody who can create objects, with out saying which privileges that takes.
Pink Hat, which ships PostgreSQL packages, says in its CVE evaluation that an attacker wants a database login with the flexibility to create or modify objects. None of those sources says whether or not an account with solely default privileges can transcend the crash to run code.
Ince traces the foundation of the flaw to Might 5, 2004, when PostgreSQL gained the flexibility to vary a column’s sort. His method for operating code depends on a later change made on Might 14, 2015.
He additionally tailored the exploit for managed PostgreSQL companies and privately shared proofs of idea with their safety groups in August. The suppliers he labored with embrace AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud. The writeup doesn’t give every service’s present patch standing.
The mission credit greater than a dozen reporters for CVE-2026-6460, together with the researcher, and credit him on 5 different flaws in the identical launch.
The mission charges 32 of the 52 flaws at 8.8, the very best rating within the launch. Primarily based on the scores in its vulnerability index, just one flaw within the server requires neither a login nor any person motion. That flaw, CVE-2026-116322, lets an unauthenticated shopper set off a restart of PostgreSQL 18 servers.
A number of different fixes are in shopper instruments. A crafted archive could make pg_restore run code because the person operating it. A compromised supply server could make psql run code by the restore script in pg_dump’s tar output.
What Directors Ought to Do
- Replace the server to 18.7, 17.12, 16.16, 15.20, or 14.25, matching your main model.
- Rebuild or replace each C-language extension similtaneously the server. Extensions constructed towards older releases nonetheless load, however they “is probably not protected against the vulnerabilities mounted on this launch,” in keeping with a repository discover from the mission’s RPM bundle maintainers. Some extensions can even want source-code modifications.
- Extensions rebuilt for the brand new releases can fail to load on older servers. Extension packages within the mission’s RPM repositories now require the brand new minor launch.
- If PostgreSQL runs exterior its bundle’s personal service unit, for instance below Patroni, restart it proper after updating, a maintainer of the RPM packages says in a packaging weblog put up.
- Replace shopper instruments similar to pg_dump, pg_restore, reindexdb and vacuumdb on each machine that runs them.
- Don’t use the brand new composite_type_mismatch setting to show off the checks. The mission says doing so carries safety dangers.
- The mission’s advisory and launch notes supply no workaround for servers that can’t be up to date but.
- PostgreSQL 14 is now end-of-life, and 14.25 is its final launch. Older main variations are additionally affected and obtained no replace.
- After updating, observe the reindexing steps within the launch announcement. In case you use incremental backups, take a brand new full backup and base later incremental backups on it.
