PostgreSQL: Type confusion vulnerability (CVE-2026-6460)
A type confusion vulnerability in PostgreSQL allows object creators to execute arbitrary code as the operating system user running the database.
CVE search metadata
CVE search record: CVE-2026-6460. KEV: no. Product: PostgreSQL. Brief: PostgreSQL: Type confusion vulnerability (CVE-2026-6460). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-6460/
Triage facts
Revision 1- Applicability
- PostgreSQL
- Evidence
- Not observed
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 12, 16:44 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-6460 is a type confusion vulnerability in PostgreSQL. The vulnerability arises from inadequate tracking of typed values, where values are not self-identifying. This allows object creators to execute arbitrary code as the operating system user running the database. Attackers may leverage DDL operations such as 'ALTER ... SET DATA TYPE' or sequences like 'ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN'.
Impact
Successful exploitation allows an object creator to execute arbitrary code with the privileges of the operating system user running the PostgreSQL service.
Recommendation
Refer to the official PostgreSQL support advisory for mitigation and patch information.
Threat Hunt
Search database audit logs and system execution logs for ALTER TABLE or ALTER...SET DATA TYPE commands originating from low-privileged database users followed immediately by shell execution or unexpected child processes spawned by the PostgreSQL OS service account.
Data: PostgreSQL audit logs, OS process execution logs (e.g., Sysmon Event ID 1 or Auditd)