Vulnerabilities & Exploits

PostgreSQL fix needs extension rebuild to close code-execution flaw

The PostgreSQL Global Development Group released fixes for 52 flaws, including CVE-2026-6460, which can let a database user with object-creation privileges execute code on the server. Researcher Mehmet Ince demonstrated the route; the project has not reported attacks using it. The updates cover versions before 18.7, 17.12, 16.16, 15.20 and 14.25.

PostgreSQL can retain an old value after a field in a composite data type changes, then misread that value as the new type. A user able to create or alter objects can exploit that mismatch to run code with the operating-system privileges of the PostgreSQL service account. Full protection also requires rebuilding installed C-language extensions, so updating the database alone may leave the flaw open.

For installations with C-language extensions, the database update is not the whole security boundary: those components also need rebuilding, and any code execution inherits the operating-system reach of the PostgreSQL service account.

2 sources · 16h ago

CVE-2026-6460

NVD KEV

CVSS 8.8 HIGH: type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... EPSS 0.6% (49th percentile).

Timeline

Sources

Part of the PlainSec briefing for 2026-11-14

Every edition of this story: PostgreSQL fix needs extension rebuild to close code-execution flaw

More from today