PostgreSQL: Type confusion in operator commutator and negator links
A type confusion vulnerability in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database.
CVE search metadata
CVE search record: CVE-2026-116335. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: Type confusion in operator commutator and negator links. Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-116335/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:56 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Type confusion exists in PostgreSQL operator commutator and negator links, which allows an object creator to execute arbitrary code as the operating system user running the database. This occurs via linking operators having different result types or creating inconsistent reciprocal links.
Impact
Successful exploitation allows an object creator to execute arbitrary code with the privileges of the operating system user running the database process.