PostgreSQL (< 17.12) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/postgresql--17.12/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 17:01:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPostgreSQL: Privilege escalation via uncontrolled search path in CREATE EXTENSION (CVE-2026-6467)https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-6467/Thu, 12 Nov 2026 17:01:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-6467/PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 contain an uncontrolled search path vulnerability that allows attackers with CREATE privileges to achieve privilege escalation via malicious schema manipulation.PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected by an uncontrolled search path element vulnerability (CVE-2026-6467). An attacker with database-level CREATE privileges can execute arbitrary code as the bootstrap superuser. The vulnerability is triggered by using commands such as ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user" to manipulate search paths. This allows a malicious trusted-extension script to locate and execute attacker-controlled SQL objects.

Impact

Successful exploitation grants an attacker with database-level CREATE privileges the ability to execute arbitrary code with the permissions of the bootstrap superuser, leading to full database compromise.

Recommendation

  • Upgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later.
  • Audit database-level permissions to identify users with CREATE privileges and assess the risk of unauthorized extension usage.
  • Monitor database audit logs for suspicious execution of ALTER SCHEMA, ALTER EXTENSION, or CREATE EXTENSION commands involving unusual schema names.
]]>highadvisorycve-2026-6467privilege-escalationdatabase