PostgreSQL patches 52 flaws, including authenticated RCE
CVE-2026-6460, CVSS 8.8, needs object-creation rights; full protection also requires rebuilding C extensions.
76
CVE-2026-6460
Type confusion RCE in PostgreSQL for object creators
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p49
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A type confusion flaw in PostgreSQL lets an object creator run arbitrary code as the operating system user that runs the database. The main path is ALTER … SET DATA TYPE; other DDL sequences, including adding a column, rolling back, and adding it again, can also trigger it. Stale typed values can linger in the data dictionary, PL/pgSQL variables, and elsewhere. Builds before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
What to do: Upgrade PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, matching the major version in use.
| Product | Affected | Fixed in |
|---|---|---|
| PostgreSQL | before 18.7, 17.12, 16.16, 15.20, and 14.25 | 18.7, 17.12, 16.16, 15.20, and 14.25 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
- Weakness
- CWE-843
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H