PostgreSQL: Improper Protection of Alternate Path in Security-Restricted Operations (CVE-2026-116316)

PostgreSQL contains a vulnerability (CVE-2026-116316) where improper protection of alternate paths during security-restricted operations allows an object creator to execute arbitrary SQL code as the session's caller. The issue arises when an attacker creates a domain, enum, or range type within a temporary schema (pg_temp). If the victim session subsequently executes a query containing an unqualified type name, the malicious type definition can be invoked. The vulnerability specifically affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL with the privileges of the victim session. This can lead to unauthorized data access, modification, or privilege escalation within the database environment. Autovacuum and other standard security-restricted users are explicitly noted as unaffected because they typically do not execute queries with unqualified type names.

Recommendation

Patch all PostgreSQL instances to the versions that contain the fix. Affected users should upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25 immediately. Prior to patching, audit database environments for the creation of temporary objects by untrusted users.