{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/postgresql--18.7--17.12--16.16--15.20--14.25/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-18447"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003eA type confusion vulnerability exists in PostgreSQL SQL-language functions that allows an object creator to execute arbitrary code as the operating system user running the database. The flaw is triggered via an output parameter of the 'any' type. The vulnerability affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user with the ability to create database objects to achieve arbitrary code execution on the underlying host with the privileges of the database service process. This presents a high risk for unauthorized system access and privilege escalation within the database environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade PostgreSQL to the patched versions: 18.7, 17.12, 16.16, 15.20, 14.25, or later. Organizations should restrict 'CREATE' permissions within the database to trusted users only to mitigate the risk of exploitation while remediation is planned.\u003c/p\u003e\n","date_modified":"2026-11-12T16:58:53Z","date_published":"2026-11-12T16:58:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-18447/","summary":"A type confusion vulnerability in PostgreSQL SQL-language functions allows an authenticated user with object creation privileges to execute arbitrary code as the database user.","title":"PostgreSQL: SQL-language function type confusion (CVE-2026-18447)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-18447/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116319"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003eA use-after-free vulnerability exists in the PostgreSQL plperl extension. An object creator can trigger this flaw through reentrant return_next() calls, which allows for the execution of arbitrary code as the operating system user running the database. This vulnerability affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.\u003c/p\u003e\n","date_modified":"2026-11-12T16:52:48Z","date_published":"2026-11-12T16:52:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-plperl-uaf-cve-2026-116319/","summary":"A use-after-free vulnerability in the PostgreSQL plperl extension allows an object creator to execute arbitrary code as the operating system user running the database via reentrant return_next() calls.","title":"PostgreSQL: Use-after-free in plperl extension (CVE-2026-116319)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-plperl-uaf-cve-2026-116319/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql_global_development_group:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116316"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","postgresql","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["PostgreSQL Global Development Group"],"content_html":"\u003cp\u003ePostgreSQL contains a vulnerability (CVE-2026-116316) where improper protection of alternate paths during security-restricted operations allows an object creator to execute arbitrary SQL code as the session's caller. The issue arises when an attacker creates a domain, enum, or range type within a temporary schema (pg_temp). If the victim session subsequently executes a query containing an unqualified type name, the malicious type definition can be invoked. The vulnerability specifically affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary SQL with the privileges of the victim session. This can lead to unauthorized data access, modification, or privilege escalation within the database environment. Autovacuum and other standard security-restricted users are explicitly noted as unaffected because they typically do not execute queries with unqualified type names.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePatch all PostgreSQL instances to the versions that contain the fix. Affected users should upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25 immediately. Prior to patching, audit database environments for the creation of temporary objects by untrusted users.\u003c/p\u003e\n","date_modified":"2026-11-12T16:52:21Z","date_published":"2026-11-12T16:52:21Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-arbitrary-sql-execution-cve-2026-116316/","summary":"A vulnerability in PostgreSQL allows an object creator to execute arbitrary SQL as the session caller by leveraging temporary schema type definitions, which are subsequently triggered by queries containing unqualified type names.","title":"PostgreSQL: Improper Protection of Alternate Path in Security-Restricted Operations (CVE-2026-116316)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-arbitrary-sql-execution-cve-2026-116316/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-116314"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003ePostgreSQL has identified a vulnerability in the pg_restore utility (CVE-2026-116314) where improper input validation in the processing of non-plain archives allows for arbitrary code execution. The vulnerability exists when pg_restore processes a maliciously crafted archive file. While pg_restore is intended to execute SQL, the vulnerability permits the execution of arbitrary code within the OS process running the tool. Affected versions are PostgreSQL 14.x before 14.25, 15.x before 15.20, 16.x before 16.16, 17.x before 17.12, and 18.x before 18.7.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to gain code execution as the operating system user account under which the pg_restore utility is executed. This can lead to full system compromise depending on the privileges of that user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PostgreSQL to the patched versions: 18.7, 17.12, 16.16, 15.20, or 14.25.\u003c/li\u003e\n\u003cli\u003eReview all automated database restore procedures and ensure that archive files processed by pg_restore originate from trusted sources only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T16:45:59Z","date_published":"2026-11-12T16:45:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-116314/","summary":"Improper input validation in PostgreSQL pg_restore allows an attacker to execute arbitrary code as the operating system user by providing a crafted non-plain archive file.","title":"PostgreSQL: pg_restore arbitrary code execution (CVE-2026-116314)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-116314/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-120145"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)"],"_cs_severities":["high"],"_cs_tags":["postgresql","rce","vulnerability"],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003ePostgreSQL is vulnerable to arbitrary code execution (CVE-2026-120145) due to missing authorization checks within its logical replication feature. A compromised publisher can execute code as the operating system user running a subscription, provided that the subscription is owned by a database superuser and targets a system catalog. The vulnerability affects all PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to execute arbitrary code with the privileges of the operating system user running the PostgreSQL service, potentially leading to full system compromise if the service runs with excessive permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing logical replication subscriptions to identify those owned by superusers.\u003c/li\u003e\n\u003cli\u003eEnsure that PostgreSQL service accounts follow the principle of least privilege to limit the impact of potential command execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T16:45:07Z","date_published":"2026-11-12T16:45:07Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-replication-rce-cve-2026-120145/","summary":"PostgreSQL logical replication contains a flaw allowing arbitrary code execution when a superuser-owned subscription targets a system catalog, impacting multiple major versions.","title":"PostgreSQL: Logical replication arbitrary code execution (CVE-2026-120145)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-replication-rce-cve-2026-120145/"}],"language":"en","title":"CraftedSignal Threat Feed - PostgreSQL (\u003c 18.7, \u003c 17.12, \u003c 16.16, \u003c 15.20, \u003c 14.25)","version":"https://jsonfeed.org/version/1.1"}