# SZB-334738b1ec: PostgreSQL releases fixes for 52 flaws, including CVE-2026-6460 type confusion bug

The PostgreSQL project released updates fixing CVE-2026-6460, a type confusion flaw rated 8.8 that lets a database user who can create objects run code on the server.

- Type: Early warning
- Kind: Pending CVE
- Vendor: PostgreSQL
- Product: PostgreSQL
- Status: Confirmed
- Sources: 15 distinct
- First seen: 2026-11-12 15:02 UTC
- Confirmed: 2026-11-13 17:34 UTC

Written by a model from the sources below. Verify against them.

## Summary

The PostgreSQL project released updates fixing CVE-2026-6460, a type confusion flaw rated 8.8 that lets a database user who can create objects run code on the server. Researcher Mehmet Ince published a writeup with a crash exploit and a memory-address leak, but withheld the final code-execution step, and no attacks have been reported by the project.

## What to do

- Update PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, matching your major version.
- Rebuild or update every C-language extension at the same time as the server.
- Restrict which database roles can create or modify objects.
- For managed PostgreSQL services, confirm with your provider whether its patch has been applied.

## Timeline

- 2026-11-12 15:01 UTC: Made public by Mastodon
- 2026-11-12 15:02 UTC: First seen by cve.now
- 2026-11-13 17:34 UTC: Confirmed as CVE-2026-6460
- 2026-11-14 15:50 UTC: Record last updated

## Evidence (15 sources)

- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604068005703821): “Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$us...” (+41 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117604068252611483), [Mastodon](https://mastodon.social/@EUVD_Bot/117604071949838769), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072022215974), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072092446283), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072138040234), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072176875266), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072206951785), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072241983345), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072275664686), [Mastodon](https://mastodon.social/@EUVD_Bot/117604072311010928), [Mastodon](https://mastodon.social/@EUVD_Bot/117604075833839499), [Mastodon](https://mastodon.social/@EUVD_Bot/117604075870229075), [Mastodon](https://mastodon.social/@EUVD_Bot/117604075942180714), [Mastodon](https://mastodon.social/@EUVD_Bot/117604075981807990), [Mastodon](https://mastodon.social/@EUVD_Bot/117604076015917587), [Mastodon](https://mastodon.social/@EUVD_Bot/117604076052688253), [Mastodon](https://mastodon.social/@EUVD_Bot/117604076081024347), [Mastodon](https://mastodon.social/@EUVD_Bot/117604076245690731), [Mastodon](https://mastodon.social/@EUVD_Bot/117604079818477286), [Mastodon](https://mastodon.social/@EUVD_Bot/117604079971790467), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080010572351), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080044060701), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080128985089), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080164808839), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080204731204), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083726962036), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083754873049), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083784960099), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083818032542), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083847033389), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083885955076), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083919674712), [Mastodon](https://mastodon.social/@EUVD_Bot/117604083977745746), [Mastodon](https://mastodon.social/@EUVD_Bot/117604084034895584), [Mastodon](https://mastodon.social/@EUVD_Bot/117604084065566895), [Mastodon](https://mastodon.social/@EUVD_Bot/117604087696336879), [Mastodon](https://mastodon.social/@EUVD_Bot/117604087723811538), [Mastodon](https://mastodon.social/@EUVD_Bot/117604087756336297), [Mastodon](https://mastodon.social/@EUVD_Bot/117604087788492731), [Mastodon](https://mastodon.social/@thehackerwire/117604307198219962), [Mastodon](https://mastodon.social/@thehackerwire/117604307805788324))
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604068039037449): “Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.” (+4 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117604068070419358), [Mastodon](https://mastodon.social/@EUVD_Bot/117604068221057902), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080071296084), [Mastodon](https://mastodon.social/@EUVD_Bot/117604080100426103))
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604068099587545): “Use of externally-controlled format string in PostgreSQL pg\_basebackup allows an attacker having already compromised a server to achieve disclosure from pg\_basebackup memory, via backup manifest bytes.” (+1 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117604076176894805))
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604068140795169): “Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLIC...”
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604068191433424): “External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.” (+1 more: [Mastodon](https://mastodon.social/@thehackerwire/117604308474551602))
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604068298098349): “Use after free in PostgreSQL pg\_show\_all\_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees.”
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604072056368227): “Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied.”
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604079925988004): “Exposure of sensitive information in PostgreSQL security\_barrier processing allows a database user to infer values hidden by a security\_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectl”
- 2026-11-12 · Social · [Reddit (r/netsec, r/cybersecurity, r/sysadmin)](https://www.reddit.com/r/netsec/comments/1xuh3jj/prepared_statements_prevents_sqli_but_it_also/): “prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460)”
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@shellsecrets/117604588466523323): “PostgreSQL fixes 52 security vulnerabilities, including arbitrary code execution, SQL injection, and CVE-2026-120154 (RLS bypass).” (+2 more: [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117606767092818343), [Mastodon](https://infosec.exchange/@thecybersecguru/117610673345013032))
- 2026-11-12 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/682): “PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released, fixes 52 security vulnerabilities”
- 2026-11-13 · Press · [The Hacker News](https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html): “A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server.”
- 2026-11-13 · Social · [Reddit (r/netsec, r/cybersecurity, r/sysadmin)](https://www.reddit.com/r/cybersecurity/comments/1xvh68j/postgresql_patches_52_vulnerabilities_including_a/): “PostgreSQL Patches 52 Vulnerabilities, Including a Code Execution Flaw That Reportedly Dates Back Two Decades”
- 2026-11-14 · Social · [Mastodon](https://infosec.exchange/@Secquill/117614823623150529): “New PostgreSQL minor releases fix a flaw whose patch also affects extensions, so RPM repository maintainers rebuilt every extension and warn against updating one without the other.”
- 2026-11-14 · Social · [Reddit (r/netsec, r/cybersecurity, r/sysadmin)](https://www.reddit.com/r/netsec/comments/1xw5ldq/ruohang_feng_postgresql_just_patched_52_cves_in_a/): “PostgreSQL Just Patched 52 CVEs in a Single Minor Release”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-334738b1ec&body=https%3A%2F%2Fcve.now%2FSZB-334738b1ec%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-334738b1ec

### Has PostgreSQL confirmed it?

Mastodon, Mastodon and Mastodon report a possible compromise. None of the sources says it happened.

Source: https://mastodon.social/@EUVD_Bot/117604068005703821, https://mastodon.social/@EUVD_Bot/117604068039037449, https://mastodon.social/@EUVD_Bot/117604068099587545, https://mastodon.social/@EUVD_Bot/117604068140795169, https://mastodon.social/@EUVD_Bot/117604068191433424, https://mastodon.social/@EUVD_Bot/117604068298098349, https://mastodon.social/@EUVD_Bot/117604072056368227, https://mastodon.social/@EUVD_Bot/117604079925988004, https://www.reddit.com/r/netsec/comments/1xuh3jj/prepared_statements_prevents_sqli_but_it_also/, https://mastodon.social/@shellsecrets/117604588466523323, https://seclists.org/oss-sec/2026/q4/682, https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html, https://www.reddit.com/r/cybersecurity/comments/1xvh68j/postgresql_patches_52_vulnerabilities_including_a/, https://infosec.exchange/@Secquill/117614823623150529, https://www.reddit.com/r/netsec/comments/1xw5ldq/ruohang_feng_postgresql_just_patched_52_cves_in_a/

### What should PostgreSQL and psql users do?

Update PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, matching your major version. Rebuild or update every C-language extension at the same time as the server. Restrict which database roles can create or modify objects. For managed PostgreSQL services, confirm with your provider whether its patch has been applied.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-6460 and CVE-2026-116322.

Source: https://cve.now/CVE-2026-6460, https://cve.now/CVE-2026-116322

## Tracked as

- [CVE-2026-6460](https://cve.now/CVE-2026-6460.md)
- [CVE-2026-116322](https://cve.now/CVE-2026-116322.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-334738b1ec
Site guide for agents: https://cve.now/llms.txt