PostgreSQL: SQL-language function type confusion (CVE-2026-18447)
A type confusion vulnerability in PostgreSQL SQL-language functions allows an authenticated user with object creation privileges to execute arbitrary code as the database user.
CVE search metadata
CVE search record: CVE-2026-18447. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25). Brief: PostgreSQL: SQL-language function type confusion (CVE-2026-18447). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-18447/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 16:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A type confusion vulnerability exists in PostgreSQL SQL-language functions that allows an object creator to execute arbitrary code as the operating system user running the database. The flaw is triggered via an output parameter of the 'any' type. The vulnerability affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.
Impact
Successful exploitation allows an authenticated user with the ability to create database objects to achieve arbitrary code execution on the underlying host with the privileges of the database service process. This presents a high risk for unauthorized system access and privilege escalation within the database environment.
Recommendation
Upgrade PostgreSQL to the patched versions: 18.7, 17.12, 16.16, 15.20, 14.25, or later. Organizations should restrict 'CREATE' permissions within the database to trusted users only to mitigate the risk of exploitation while remediation is planned.
Threat Hunt
Monitor database process activity for child processes spawned by the PostgreSQL service (postgres) that correspond to system command execution or shell initiation, indicating exploitation of arbitrary code execution via SQL-language functions.
Data: Process creation events (ProcessName, ParentProcessName, CommandLine)
Mitigations
Upgrade PostgreSQL to version 18.7, 17.12, 16.16, 15.20, 14.25, or later
CVE-2026-18447
Gaps
- No specific Sigma detection available; monitor for creation of suspicious SQL functions or excessive use of administrative permissions