PostgreSQL fixes 52 flaws, including authenticated code-execution bug

PostgreSQL maintainers have released security updates addressing 52 flaws, including a type-confusion vulnerability that could let a database user with object-creation privileges execute code on the server. The issue, tracked as CVE-2026-6460 and rated CVSS 8.8, affects supported PostgreSQL release lines before versions 18.7, 17.12, 16.16, 15.20 and 14.25.

Administrators need to update the database server and rebuild or update installed C-language extensions to fully address CVE-2026-6460. The PostgreSQL project warns that extensions built against older releases may remain unprotected by the fixes. The updates also include changes to client utilities, so organizations should review and update tools such as pg_dump, pg_restore, reindexdb and vacuumdb on every system where they run.

How the flaw can lead to server code execution

The vulnerability concerns PostgreSQL composite types, which group named fields with individual data types. According to the available technical description, a field’s type could be changed while older values remained elsewhere in the server. PostgreSQL might then interpret an existing value using the field’s new type, creating a type mismatch that could be abused.

The fix adds version checks intended to detect values that no longer match their types. Code executed through the flaw would run with the operating-system privileges of the account running PostgreSQL, rather than automatically gaining system-wide administrator privileges.

Researcher Mehmet Ince published a technical account of a working exploit demonstrated against PostgreSQL 18.6. The account describes preparing a query that retains a value, changing a field’s type and then executing the query. It details steps that can crash an unpatched server and disclose memory addresses, but does not provide the final command-execution SQL.

Ince said he could trigger a crash with a low-privilege login role. However, the project’s advisory describes the attacker as someone able to create objects, and Red Hat’s assessment says an attacker needs a database login that can create or modify objects. The published information does not establish whether default privileges alone are sufficient to progress from a crash to code execution.

Exposure and related fixes

The PostgreSQL Global Development Group has not reported attacks exploiting CVE-2026-6460, and the CVE record’s CISA assessment lists exploitation as none. Ince traced the underlying type-change capability to a PostgreSQL change from May 5, 2004, and said the technique for executing code depended on a later change made on May 14, 2015.

He also adapted proof-of-concept work for managed PostgreSQL services and privately shared it with security teams in August. The providers named include AWS Aurora and RDS, Microsoft Azure PostgreSQL, Google AlloyDB, Supabase, Databricks and Ubicloud. The technical account does not state the current patch status of each service, so customers should check directly with their providers.

The release addresses 51 additional security issues. The project rated 32 of the 52 flaws at 8.8, the highest score in this release. Based on the project’s vulnerability index, CVE-2026-116322 is the only server flaw listed as requiring neither a login nor user action; it can allow an unauthenticated client to trigger a restart of PostgreSQL 18 servers.

Other fixes affect client-side utilities. A crafted archive could cause pg_restore to execute code with the privileges of the user running it. Separately, a compromised source server could cause psql to execute code through a restore script in pg_dump’s tar output. These risks make it important to update client tools as well as database servers.

Recommended administrator actions

• Upgrade each server to the fixed minor release for its major version: 18.7, 17.12, 16.16, 15.20 or 14.25.
• Rebuild or update every installed C-language extension alongside the server update. Some extensions may require source-code changes, and extensions rebuilt for a newer release may not load on older servers.
• If PostgreSQL is managed outside its package’s service unit, including under Patroni, restart it promptly after updating, as advised by a maintainer of the project’s RPM packages.
• Update PostgreSQL client utilities wherever they are installed. Do not disable the new composite_type_mismatch checks; the project warns that doing so creates security risk.

The project provides no workaround for systems that cannot be updated. PostgreSQL 14.25 is the final release for PostgreSQL 14, which has reached end of life; older affected major versions also received no update. After patching, administrators should follow the release announcement’s reindexing instructions. Organizations using incremental backups should take a new full backup and base subsequent incremental backups on it.