PostgreSQL: Type confusion remote code execution (CVE-2026-116329)
PostgreSQL versions 18.x before 18.7 contain a type confusion vulnerability in the statistics import mechanism that allows an authenticated table maintainer to execute arbitrary code with the privileges of the database service.
CVE search metadata
CVE search record: CVE-2026-116329. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL (< 18.7). Brief: PostgreSQL: Type confusion remote code execution (CVE-2026-116329). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-116329/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
PostgreSQL versions 18.x series prior to 18.7 contain a type confusion vulnerability within the statistics import mechanism. An attacker with 'table maintainer' privileges can trigger this vulnerability using nested SET DATA TYPE commands during value conversion, resulting in arbitrary code execution under the security context of the database service process. The vulnerability does not affect versions prior to 18.0.
Impact
Successful exploitation results in arbitrary code execution under the security context of the database service process. A user must hold 'table maintainer' privileges to successfully trigger the vulnerability.
Recommendation
Patch all affected instances to PostgreSQL 18.7 or later immediately. Review database user permissions to ensure that only authorized, trusted users hold 'table maintainer' privileges.
Immediate actions
Upgrade all PostgreSQL 18.x instances to version 18.7 or later.
Audit current database users for 'table maintainer' privileges and restrict access to trusted accounts only.
Threat Hunt
Investigate database logs for suspicious, high-frequency, or recursive use of 'SET DATA TYPE' commands from accounts with table maintenance privileges.
Data: Database audit logs, PostgreSQL statement logging
Mitigations
Upgrade PostgreSQL to version 18.7
CVE-2026-116329