{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apostgresql_global_development_grouppostgresql/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql_global_development_group:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116316"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","postgresql","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["PostgreSQL Global Development Group"],"content_html":"\u003cp\u003ePostgreSQL contains a vulnerability (CVE-2026-116316) where improper protection of alternate paths during security-restricted operations allows an object creator to execute arbitrary SQL code as the session's caller. The issue arises when an attacker creates a domain, enum, or range type within a temporary schema (pg_temp). If the victim session subsequently executes a query containing an unqualified type name, the malicious type definition can be invoked. The vulnerability specifically affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary SQL with the privileges of the victim session. This can lead to unauthorized data access, modification, or privilege escalation within the database environment. Autovacuum and other standard security-restricted users are explicitly noted as unaffected because they typically do not execute queries with unqualified type names.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePatch all PostgreSQL instances to the versions that contain the fix. Affected users should upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25 immediately. Prior to patching, audit database environments for the creation of temporary objects by untrusted users.\u003c/p\u003e\n","date_modified":"2026-11-12T16:52:21Z","date_published":"2026-11-12T16:52:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-arbitrary-sql-execution-cve-2026-116316/","summary":"A vulnerability in PostgreSQL allows an object creator to execute arbitrary SQL as the session caller by leveraging temporary schema type definitions, which are subsequently triggered by queries containing unqualified type names.","title":"PostgreSQL: Improper Protection of Alternate Path in Security-Restricted Operations (CVE-2026-116316)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-arbitrary-sql-execution-cve-2026-116316/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:postgresql_global_development_group:postgresql:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}