PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug

PostgreSQL has released updates fixing 52 security flaws, including CVE-2026-6460, a type confusion bug with a CVSS score of 8.8 that can let an authenticated database user with object creation rights execute code on the server. The PostgreSQL Global Development Group has not reported attacks exploiting the flaw, and CISA lists exploitation as none.

The flaw

CVE-2026-6460 affects all PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 and 14.25. It involves composite types, built from named fields, each with its own data type. A field's type can be changed while older values of that type remain held elsewhere, so the server could read an old value as if it had the new type. The fix adds version checks to detect a mismatch. Code run through the flaw has the rights of the operating system user that runs PostgreSQL.

Exploit research

Security researcher Mehmet Ince published a technical writeup this week describing a working exploit on PostgreSQL 18.6. His method prepares a query holding a value, changes the type of one field, then runs the query. The writeup includes SQL that crashes an unpatched server and a second step leaking memory addresses, but not the SQL for the final step that makes the server run a command. He wrote that he could trigger the crash as a lowest privileged login role. The advisory describes the attacker as someone who can create objects, without stating required privileges. Red Hat says an attacker needs a database login able to create or modify objects. None of these sources says whether an account with only default privileges can go beyond the crash to run code.

Ince traces the flaw's root to May 5, 2004, when PostgreSQL gained the ability to change a column's type. His code execution technique relies on a later change made on May 14, 2015. He also adapted the exploit for managed PostgreSQL services and shared proofs of concept with providers' security teams in August.

Other fixes

The project credits more than a dozen reporters for CVE-2026-6460 and credits Ince on five other flaws in the same release. It rates 32 of the 52 flaws at 8.8, the highest score in the release. Based on its vulnerability index, only one server flaw requires neither a login nor user action: CVE-2026-116322 lets an unauthenticated client trigger a restart of PostgreSQL 18 servers. Client tool fixes include a crafted archive that can make pg_restore run code as its user, and a compromised source server that can make psql run code through pg_dump's tar output.

Administrator actions

Update the server to 18.7, 17.12, 16.16, 15.20 or 14.25, matching the major version. Rebuild or update every C language extension at the same time. Extensions built against older releases still load, but may not be protected from the vulnerabilities fixed in this release. If PostgreSQL runs outside its package's own service unit, for example under Patroni, restart it right after updating. Update client tools such as pg_dump, pg_restore, reindexdb and vacuumdb on every machine that runs them. Do not use the new composite_type_mismatch setting to turn off the checks, because the project says doing so carries security risks. The advisory and release notes offer no workaround for servers that cannot be updated yet.

PostgreSQL 14 is now end of life, and 14.25 is its last release. Older major versions are also affected and received no update. After updating, follow the reindexing steps in the release announcement. If you use incremental backups, take a new full backup and base later incremental backups on it.

Sources: The Hacker News