Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11141 | Publication Date: 14 November 2026

PostgreSQL Type Confusion Leading to Arbitrary Code Execution
CVE-2026-6460

Summary

A high-severity type confusion vulnerability has been identified in the PostgreSQL core server. Tracked as CVE-2026-6460, the flaw allows a database user with permission to create objects to execute arbitrary code as the operating system user under which the database server is running.

The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High). It is not unauthenticated; exploitation requires the ability to create or alter database objects (CREATE privilege or equivalent). Fixed releases were published on 12 November 2026 for all currently supported major branches.

Technical Overview

PostgreSQL did not adequately track the type associated with certain internal values. Values were not self-identifying, and stale typed values could persist in data dictionary entries, PL/pgSQL variables, and other parts of the system after schema changes.

The primary attack path uses ALTER ... SET DATA TYPE (and related DDL sequences such as ALTER TABLE ... ADD COLUMN combined with rollback and re-execution). By changing the type of an attribute after a statement has been prepared or a value has been stored, an attacker can cause the server to interpret data under an incompatible type. This type confusion can be leveraged to achieve arbitrary code execution in the context of the PostgreSQL process.

The underlying design issue is long-standing (described in public research as originating approximately 22 years ago). The recent research demonstrated a reliable path from the type confusion to code execution.

Affected Systems

• PostgreSQL 18 before 18.7
• PostgreSQL 17 before 17.12
• PostgreSQL 16 before 16.16
• PostgreSQL 15 before 15.20
• PostgreSQL 14 before 14.25

Fixed versions: 18.7, 17.12, 16.16, 15.20, and 14.25 (released 12 November 2026). Note that 14.25 is the final release of the PostgreSQL 14 branch, which has reached end of life.

Exploitation Status

• Official disclosure and security releases published on 12 November 2026.
• Public technical analysis and proof-of-concept material exist.
• Exploitation requires a database role that can create or alter objects; it is not a fully unauthenticated remote attack.
• No widespread in-the-wild exploitation confirmed as of this advisory’s publication.
• Not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.

Recommendations

1. Immediate Action: Upgrade PostgreSQL to the fixed minor release for your major branch (18.7, 17.12, 16.16, 15.20, or 14.25).
2. After upgrading, restart the PostgreSQL service so the patched binary is loaded.
3. Inventory all PostgreSQL instances and identify roles that hold CREATE privileges on databases or schemas. Prioritize environments where less-trusted users or applications can create objects (multi-tenant systems, shared hosting, development databases with broader access).
4. Where possible, restrict DDL privileges (especially ALTER ... SET DATA TYPE and related schema-modification rights) to trusted administrative roles only.
5. Review application and database logs for unusual DDL activity or unexpected process behavior around and after 12 November 2026.
6. For managed PostgreSQL services (cloud providers, DBaaS), confirm with the provider that the security updates have been applied to your instances.
7. If compromise is suspected, treat the host as compromised: isolate it, preserve forensic evidence, rotate credentials and secrets accessible to the database process, and perform a full integrity review.

Although this vulnerability is not unauthenticated, the combination of relatively low required privileges, reliable code execution, and the widespread deployment of PostgreSQL makes timely patching essential, especially in multi-user or multi-tenant environments.

Karen IT
We make the Internet harder to abuse.