PostgreSQL: Privilege escalation via uncontrolled search path in CREATE EXTENSION (CVE-2026-6467)
PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 contain an uncontrolled search path vulnerability that allows attackers with CREATE privileges to achieve privilege escalation via malicious schema manipulation.
CVE search metadata
CVE search record: CVE-2026-6467. Severity: high. CVSS: 7.2. KEV: no. Product: PostgreSQL (< 14.25), PostgreSQL (< 15.20), PostgreSQL (< 16.16), PostgreSQL (< 17.12), PostgreSQL (< 18.7). Brief: PostgreSQL: Privilege escalation via uncontrolled search path in CREATE EXTENSION (CVE-2026-6467). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-6467/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 14.25), PostgreSQL (< 15.20) +3
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 17:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected by an uncontrolled search path element vulnerability (CVE-2026-6467). An attacker with database-level CREATE privileges can execute arbitrary code as the bootstrap superuser. The vulnerability is triggered by using commands such as ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user" to manipulate search paths. This allows a malicious trusted-extension script to locate and execute attacker-controlled SQL objects.
Impact
Successful exploitation grants an attacker with database-level CREATE privileges the ability to execute arbitrary code with the permissions of the bootstrap superuser, leading to full database compromise.
Recommendation
- Upgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later.
- Audit database-level permissions to identify users with CREATE privileges and assess the risk of unauthorized extension usage.
- Monitor database audit logs for suspicious execution of ALTER SCHEMA, ALTER EXTENSION, or CREATE EXTENSION commands involving unusual schema names.
Immediate actions
Upgrade PostgreSQL to the patched versions (18.7, 17.12, 16.16, 15.20, or 14.25)
Threat Hunt
Investigate database audit logs for CREATE EXTENSION or ALTER SCHEMA commands issued by non-admin users that reference unusual schemas or user-specific search paths.
Data: PostgreSQL audit logs, Database query logs
Mitigations
Patch PostgreSQL to 18.7 or later
CVE-2026-6467