PostgreSQL (< 18.7) - CraftedSignal Threat Feed

PostgreSQL: Privilege escalation via uncontrolled search path in CREATE EXTENSION (CVE-2026-6467)

hello@craftedsignal.io — Thu, 12 Nov 2026 17:01:19 +0000

PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected by an uncontrolled search path element vulnerability (CVE-2026-6467). An attacker with database-level CREATE privileges can execute arbitrary code as the bootstrap superuser. The vulnerability is triggered by using commands such as ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user" to manipulate search paths. This allows a malicious trusted-extension script to locate and execute attacker-controlled SQL objects.

Impact

Successful exploitation grants an attacker with database-level CREATE privileges the ability to execute arbitrary code with the permissions of the bootstrap superuser, leading to full database compromise.

Recommendation

Upgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later.
Audit database-level permissions to identify users with CREATE privileges and assess the risk of unauthorized extension usage.
Monitor database audit logs for suspicious execution of ALTER SCHEMA, ALTER EXTENSION, or CREATE EXTENSION commands involving unusual schema names.

PostgreSQL: Arbitrary code execution via type-cache invalidation (CVE-2026-120144)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:57:35 +0000

CVE-2026-120144 describes a type confusion vulnerability in PostgreSQL major version 18 caused by incomplete type-cache invalidation. An object creator can trigger this flaw by modifying a composite type while its cache entry is being populated. Successful exploitation results in arbitrary code execution with the privileges of the operating system user running the PostgreSQL database process.

Recommendation

Upgrade instances to PostgreSQL 18.7 or later to address the vulnerability.

PostgreSQL: Type confusion remote code execution (CVE-2026-116329)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:56:00 +0000

PostgreSQL versions 18.x series prior to 18.7 contain a type confusion vulnerability within the statistics import mechanism. An attacker with 'table maintainer' privileges can trigger this vulnerability using nested SET DATA TYPE commands during value conversion, resulting in arbitrary code execution under the security context of the database service process. The vulnerability does not affect versions prior to 18.0.

Impact

Successful exploitation results in arbitrary code execution under the security context of the database service process. A user must hold 'table maintainer' privileges to successfully trigger the vulnerability.

Recommendation

Patch all affected instances to PostgreSQL 18.7 or later immediately. Review database user permissions to ensure that only authorized, trusted users hold 'table maintainer' privileges.

PostgreSQL: Denial of service via pre-authentication cancel request (CVE-2026-116322)

hello@craftedsignal.io — Thu, 12 Nov 2026 16:45:43 +0000

A vulnerability (CVE-2026-116322) in PostgreSQL allows an unauthenticated network client to trigger a server restart. The flaw exists due to improper locking in the startup processing logic. Specifically, an attacker can arrange for an authentication_timeout to occur while they hold a spinlock during cancel request handling. This vulnerability affects PostgreSQL major version 18, specifically minor versions prior to 18.7.

Impact

Successful exploitation results in a denial of service condition caused by an unexpected server restart.

Recommendation

Immediately upgrade all PostgreSQL 18 instances to version 18.7 or later to remediate the vulnerability. Administrators should prioritize patching internet-facing database instances.