PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25) - CraftedSignal Threat Feed

PostgreSQL: SQL-language function type confusion (CVE-2026-18447)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:58:53 +0000

A type confusion vulnerability exists in PostgreSQL SQL-language functions that allows an object creator to execute arbitrary code as the operating system user running the database. The flaw is triggered via an output parameter of the 'any' type. The vulnerability affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.

Impact

Successful exploitation allows an authenticated user with the ability to create database objects to achieve arbitrary code execution on the underlying host with the privileges of the database service process. This presents a high risk for unauthorized system access and privilege escalation within the database environment.

Recommendation

Upgrade PostgreSQL to the patched versions: 18.7, 17.12, 16.16, 15.20, 14.25, or later. Organizations should restrict 'CREATE' permissions within the database to trusted users only to mitigate the risk of exploitation while remediation is planned.

PostgreSQL: Use-after-free in plperl extension (CVE-2026-116319)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:52:48 +0000

A use-after-free vulnerability exists in the PostgreSQL plperl extension. An object creator can trigger this flaw through reentrant return_next() calls, which allows for the execution of arbitrary code as the operating system user running the database. This vulnerability affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.

PostgreSQL: Improper Protection of Alternate Path in Security-Restricted Operations (CVE-2026-116316)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:52:21 +0000

PostgreSQL contains a vulnerability (CVE-2026-116316) where improper protection of alternate paths during security-restricted operations allows an object creator to execute arbitrary SQL code as the session's caller. The issue arises when an attacker creates a domain, enum, or range type within a temporary schema (pg_temp). If the victim session subsequently executes a query containing an unqualified type name, the malicious type definition can be invoked. The vulnerability specifically affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL with the privileges of the victim session. This can lead to unauthorized data access, modification, or privilege escalation within the database environment. Autovacuum and other standard security-restricted users are explicitly noted as unaffected because they typically do not execute queries with unqualified type names.

Recommendation

Patch all PostgreSQL instances to the versions that contain the fix. Affected users should upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25 immediately. Prior to patching, audit database environments for the creation of temporary objects by untrusted users.

PostgreSQL: pg_restore arbitrary code execution (CVE-2026-116314)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:45:59 +0000

PostgreSQL has identified a vulnerability in the pg_restore utility (CVE-2026-116314) where improper input validation in the processing of non-plain archives allows for arbitrary code execution. The vulnerability exists when pg_restore processes a maliciously crafted archive file. While pg_restore is intended to execute SQL, the vulnerability permits the execution of arbitrary code within the OS process running the tool. Affected versions are PostgreSQL 14.x before 14.25, 15.x before 15.20, 16.x before 16.16, 17.x before 17.12, and 18.x before 18.7.

Impact

Successful exploitation allows an attacker to gain code execution as the operating system user account under which the pg_restore utility is executed. This can lead to full system compromise depending on the privileges of that user.

Recommendation

Upgrade PostgreSQL to the patched versions: 18.7, 17.12, 16.16, 15.20, or 14.25.
Review all automated database restore procedures and ensure that archive files processed by pg_restore originate from trusted sources only.

PostgreSQL: Logical replication arbitrary code execution (CVE-2026-120145)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:45:07 +0000

PostgreSQL is vulnerable to arbitrary code execution (CVE-2026-120145) due to missing authorization checks within its logical replication feature. A compromised publisher can execute code as the operating system user running a subscription, provided that the subscription is owned by a database superuser and targets a system catalog. The vulnerability affects all PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the operating system user running the PostgreSQL service, potentially leading to full system compromise if the service runs with excessive permissions.

Recommendation

Upgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later immediately.
Audit existing logical replication subscriptions to identify those owned by superusers.
Ensure that PostgreSQL service accounts follow the principle of least privilege to limit the impact of potential command execution.