Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

PostgreSQL releases fixes for 52 flaws, including CVE-2026-6460 type confusion bug

The PostgreSQL project released updates fixing CVE-2026-6460, a type confusion flaw rated 8.8 that lets a database user who can create objects run code on the server.

SZB-334738b1ecPending CVEConfirmed

Written by a model from the sources below. Verify against them.

Sources15Confirmed
Kind
Pending CVE
Vendor
PostgreSQL
Product
PostgreSQL
Status
Confirmed
First seen
Confirmed

Summary

The PostgreSQL project released updates fixing CVE-2026-6460, a type confusion flaw rated 8.8 that lets a database user who can create objects run code on the server. Researcher Mehmet Ince published a writeup with a crash exploit and a memory-address leak, but withheld the final code-execution step, and no attacks have been reported by the project.

What to do

  • Update PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, matching your major version.

  • Rebuild or update every C-language extension at the same time as the server.

  • Restrict which database roles can create or modify objects.

  • For managed PostgreSQL services, confirm with your provider whether its patch has been applied.

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now1 day
  3. Confirmed as CVE-2026-64601 day
  4. Record last updated

Evidence 15

  1. Social
    Mastodon
    “Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$us...”
    +41 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  2. Social
    Mastodon
    “Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.”
    +4 more: Mastodon, Mastodon, Mastodon, Mastodon
  3. Social
    Mastodon
    “Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes.”
    +1 more: Mastodon
  4. Social
    Mastodon
    “Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLIC...”
  5. Social
    Mastodon
    “External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.”
    +1 more: Mastodon
  6. Social
    Mastodon
    “Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees.”
  7. Social
    Mastodon
    “Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied.”
  8. Social
    Mastodon
    “Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectl”
  9. Social
    Reddit (r/netsec, r/cybersecurity, r/sysadmin)
    “prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)”
  10. Social
    Mastodon
    “PostgreSQL fixes 52 security vulnerabilities, including arbitrary code execution, SQL injection, and CVE-2026-120154 (RLS bypass).”
    +2 more: Mastodon, Mastodon
  11. Social
    oss-security
    “PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released, fixes 52 security vulnerabilities”
  12. Press
    The Hacker News
    “A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server.”
  13. Social
    Reddit (r/netsec, r/cybersecurity, r/sysadmin)
    “PostgreSQL Patches 52 Vulnerabilities, Including a Code Execution Flaw That Reportedly Dates Back Two Decades”
  14. Social
    Mastodon
    “New PostgreSQL minor releases fix a flaw whose patch also affects extensions, so RPM repository maintainers rebuilt every extension and warn against updating one without the other.”
  15. Social
    Reddit (r/netsec, r/cybersecurity, r/sysadmin)
    “PostgreSQL Just Patched 52 CVEs in a Single Minor Release”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-334738b1ec

Has PostgreSQL confirmed it?

Mastodon, Mastodon and Mastodon report a possible compromise. None of the sources says it happened.Source: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Reddit (r/netsec, r/cybersecurity, r/sysadmin), Mastodon, oss-security, The Hacker News, Reddit (r/netsec, r/cybersecurity, r/sysadmin), Mastodon, Reddit (r/netsec, r/cybersecurity, r/sysadmin)

What should PostgreSQL and psql users do?

Update PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, matching your major version. Rebuild or update every C-language extension at the same time as the server. Restrict which database roles can create or modify objects. For managed PostgreSQL services, confirm with your provider whether its patch has been applied.

Does it have a CVE?

Yes. It is tracked as CVE-2026-6460 and CVE-2026-116322.Source: CVE-2026-6460, CVE-2026-116322

Sources

Tracked as