PostgreSQL fixes 52 vulnerabilities including critical arbitrary code execution across multiple versions
On November 12, 2026, PostgreSQL released versions 18.7, 17.12, 16.16, 15.20, and 14.25 addressing 52 security vulnerabilities. Of these, 32 flaws allow authenticated database users or users with object creation privileges to execute arbitrary code as the operating system user running PostgreSQL, posing significant risks especially in multi-tenant or hosted environments. The highest severity CVE (CVE-2026-6460) scores 8.8 (High CVSSv3). Notably, PostgreSQL 14 reaches end-of-life with this release and will no longer receive patches. No active exploitation or public proof-of-concept has yet been confirmed. The vulnerabilities include common memory corruption issues such as type confusion, use-after-free, and buffer overflows, affecting core database features including PL/Perl, PL/Tcl languages, triggers, dblink, and client tools like pg_dump and pg_restore. Certain bugs enable unusual attack vectors, such as compromised publishers attacking subscribers or hostile foreign servers attacking querying databases. Immediate application of these updates is recommended, along with auditing users with CREATE privileges and reindexing affected indexes. Planning migration off PostgreSQL 14 is advised as PostgreSQL 19 is upcoming.
Entenda a falha
A vulnerabilidade
PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, released on November 12, 2026, fix 52 CVEs. Of these, 32 let an authenticated user, often one who can create objects, run code as the operating system account running PostgreSQL. The highest rated is CVE-2026-6460 (CVSS 8.8), a type confusion triggered through DDL such as changing a column's data type. CVE-2026-120141 and CVE-2026-120139 need only an ordinary login. CVE-2026-120145 lets a compromised publisher attack a subscriber when a superuser owns the subscription. CVE-2026-120149 lets a hostile foreign server attack the database that queries it. CVE-2026-116314 is code execution through crafted archives in pg_restore. CVE-2026-116322 lets an unauthenticated client force a server restart on version 18. All branches before the fixed releases are affected. PostgreSQL 14.25 is the last release for that branch.
Como funciona
For CVE-2026-6460, a user with object creation rights alters a column's data type. The server keeps stale values that were stored under the old type and later interprets them as the new one, which is the type confusion. That corrupts memory inside the server process, which runs as the operating system user. Other flaws follow the same pattern in different places: PL/Perl and PL/Tcl, triggers, dblink, text search functions, replication and client tools. In replication and foreign-server cases the direction is reversed: the remote side sends data that the receiving database handles unsafely. In pg_restore, a crafted archive is processed unsafely when it is restored.
Por que é vulnerável
Most flaws are memory-safety bugs: type confusion, use-after-free and buffer overflows. The articles also list SQL injection and search path flaws in pg_dump, reindexdb and vacuumdb, row-level security bypasses and privilege checks that roles can skip. A common assumption was that data coming from users, remote servers or archives could be handled safely. The advisory notes that for CVE-2026-6460 other DDL attack routes exist. The articles do not detail what each fix changes, only that updating the binaries is enough, with no dump and reload.
Onde está
The articles name components, not files or functions: PL/Perl, PL/Tcl, triggers, dblink, text search functions, logical replication, and the pg_dump, pg_restore, reindexdb and vacuumdb tools.
Como foi descoberta
The articles do not say who found the flaws or how. They only report that the PostgreSQL project published the fixes and an advisory on November 12, 2026. The source notes this is far larger than recent releases, since HeroDevs counted 28 fixes in the August release. No exploitation in the wild has been confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:15.
Linha do tempo
-
PostgreSQL fixes 52 vulnerabilities including critical arbitrary code execution across multiple versions
ler a análise desta fonte ocultar
On November 12, 2026, PostgreSQL released versions 18.7, 17.12, 16.16, 15.20, and 14.25 addressing 52 security vulnerabilities. Of these, 32 flaws allow authenticated database users or users with object creation privileges to execute arbitrary code as the operating system user running PostgreSQL, posing significant risks especially in multi-tenant or hosted environments. The highest severity CVE (CVE-2026-6460) scores 8.8 (High CVSSv3). Notably, PostgreSQL 14 reaches end-of-life with this release and will no longer receive patches. No active exploitation or public proof-of-concept has yet been confirmed. The vulnerabilities include common memory corruption issues such as type confusion, use-after-free, and buffer overflows, affecting core database features including PL/Perl, PL/Tcl languages, triggers, dblink, and client tools like pg_dump and pg_restore. Certain bugs enable unusual attack vectors, such as compromised publishers attacking subscribers or hostile foreign servers attacking querying databases. Immediate application of these updates is recommended, along with auditing users with CREATE privileges and reindexing affected indexes. Planning migration off PostgreSQL 14 is advised as PostgreSQL 19 is upcoming.