{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/postgresql--18.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-6467"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 14.25)","PostgreSQL (\u003c 15.20)","PostgreSQL (\u003c 16.16)","PostgreSQL (\u003c 17.12)","PostgreSQL (\u003c 18.7)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-6467","privilege-escalation","database"],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003ePostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected by an uncontrolled search path element vulnerability (CVE-2026-6467). An attacker with database-level CREATE privileges can execute arbitrary code as the bootstrap superuser. The vulnerability is triggered by using commands such as ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \u0026quot;$user\u0026quot; to manipulate search paths. This allows a malicious trusted-extension script to locate and execute attacker-controlled SQL objects.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an attacker with database-level CREATE privileges the ability to execute arbitrary code with the permissions of the bootstrap superuser, leading to full database compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later.\u003c/li\u003e\n\u003cli\u003eAudit database-level permissions to identify users with CREATE privileges and assess the risk of unauthorized extension usage.\u003c/li\u003e\n\u003cli\u003eMonitor database audit logs for suspicious execution of ALTER SCHEMA, ALTER EXTENSION, or CREATE EXTENSION commands involving unusual schema names.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T17:01:19Z","date_published":"2026-11-12T17:01:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-6467/","summary":"PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 contain an uncontrolled search path vulnerability that allows attackers with CREATE privileges to achieve privilege escalation via malicious schema manipulation.","title":"PostgreSQL: Privilege escalation via uncontrolled search path in CREATE EXTENSION (CVE-2026-6467)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-6467/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-120144"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003eCVE-2026-120144 describes a type confusion vulnerability in PostgreSQL major version 18 caused by incomplete type-cache invalidation. An object creator can trigger this flaw by modifying a composite type while its cache entry is being populated. Successful exploitation results in arbitrary code execution with the privileges of the operating system user running the PostgreSQL database process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade instances to PostgreSQL 18.7 or later to address the vulnerability.\u003c/p\u003e\n","date_modified":"2026-11-12T16:57:35Z","date_published":"2026-11-12T16:57:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-120144/","summary":"A type confusion vulnerability in PostgreSQL version 18 related to incomplete type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database.","title":"PostgreSQL: Arbitrary code execution via type-cache invalidation (CVE-2026-120144)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-120144/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116329"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003ePostgreSQL versions 18.x series prior to 18.7 contain a type confusion vulnerability within the statistics import mechanism. An attacker with 'table maintainer' privileges can trigger this vulnerability using nested SET DATA TYPE commands during value conversion, resulting in arbitrary code execution under the security context of the database service process. The vulnerability does not affect versions prior to 18.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution under the security context of the database service process. A user must hold 'table maintainer' privileges to successfully trigger the vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePatch all affected instances to PostgreSQL 18.7 or later immediately. Review database user permissions to ensure that only authorized, trusted users hold 'table maintainer' privileges.\u003c/p\u003e\n","date_modified":"2026-11-12T16:56:00Z","date_published":"2026-11-12T16:56:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-116329/","summary":"PostgreSQL versions 18.x before 18.7 contain a type confusion vulnerability in the statistics import mechanism that allows an authenticated table maintainer to execute arbitrary code with the privileges of the database service.","title":"PostgreSQL: Type confusion remote code execution (CVE-2026-116329)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-type-confusion-cve-2026-116329/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-116322"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL (\u003c 18.7)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-116322) in PostgreSQL allows an unauthenticated network client to trigger a server restart. The flaw exists due to improper locking in the startup processing logic. Specifically, an attacker can arrange for an authentication_timeout to occur while they hold a spinlock during cancel request handling. This vulnerability affects PostgreSQL major version 18, specifically minor versions prior to 18.7.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial of service condition caused by an unexpected server restart.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eImmediately upgrade all PostgreSQL 18 instances to version 18.7 or later to remediate the vulnerability. Administrators should prioritize patching internet-facing database instances.\u003c/p\u003e\n","date_modified":"2026-11-12T16:45:43Z","date_published":"2026-11-12T16:45:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-116322/","summary":"An unauthenticated remote attacker can trigger a server restart in PostgreSQL versions 18 through 18.6 by sending a specially crafted cancel request during the authentication process.","title":"PostgreSQL: Denial of service via pre-authentication cancel request (CVE-2026-116322)","url":"https://feed.craftedsignal.io/briefs/2026-11-postgresql-cve-2026-116322/"}],"language":"en","title":"CraftedSignal Threat Feed - PostgreSQL (\u003c 18.7)","version":"https://jsonfeed.org/version/1.1"}