NEWS

PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

CVE-2026-6460 (CVSS 8.8) is a type confusion bug letting an object-creating user run code. Update to 18.7, 17.12, 16.16, 15.20 or 14.25 and rebuild C extensions.

Dylan H.

News Desk

November 13, 2026
3 min read
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

Overview

The PostgreSQL project released updates fixing 52 security flaws, led by CVE-2026-6460 (CVSS 8.8), a type confusion bug in composite types. A database user who can create objects can run code on the server with the privileges of the OS user running PostgreSQL. 32 of the flaws score 8.8, the highest in the release.

CVE-2026-6460

  • Affected: all versions before 18.7, 17.12, 16.16, 15.20 and 14.25.
  • Fixed in: those same releases, which add version checks so the server can detect a value that no longer matches its type.
  • Age: the bug traces to May 5, 2004, when PostgreSQL gained the ability to change a column's type. The exploit technique relies on a later change from May 14, 2015.
  • Exploitation: none reported, and the CISA CVE record lists exploitation as none.
  • Public exploit work: researcher Mehmet Ince published a working exploit against PostgreSQL 18.6. The writeup includes SQL that crashes an unpatched server and a step that leaks memory addresses, but omits the final code-execution step. He adapted it for managed services including AWS Aurora and RDS, Azure PostgreSQL, AlloyDB, Supabase, Databricks and Ubicloud; their patch status was not stated.

Rebuild C Extensions

Full protection also requires rebuilding every C-language extension alongside the server. Older extensions still load but may not be protected, and some need source changes. Extensions rebuilt for the new releases can fail to load on older servers, and RPM extension packages now require the new minor release.

Other Notable Fixes

  • CVE-2026-116322 is the only flaw needing neither login nor user action; an unauthenticated client can restart PostgreSQL 18 servers.
  • A crafted archive can make pg_restore run code as the user running it.
  • A compromised source server can make psql run code through the restore script in pg_dump tar output.

Recommended Actions

  1. Upgrade to 18.7, 17.12, 16.16, 15.20 or 14.25 and rebuild C extensions against the new release.
  2. Do not disable the new composite_type_mismatch setting; the project says that carries security risks.
  3. No workaround exists for servers that cannot be updated, so limit who holds object-creation privileges in the meantime.
  4. Follow the reindexing steps in the release announcement. If you use incremental backups, take a new full backup and base later incrementals on it.
  5. PostgreSQL 14 is end-of-life at 14.25. Older major versions are affected but received no update, so plan migration.
  6. Check with your managed database provider for their patch status.

Sources