PostgreSQL releases patches for 52 vulnerabilities, including 22-year-old bug allowing authenticated RCE

On November 13, 2026, the PostgreSQL community released a set of patches covering 52 security flaws, including a 22-year-old bug (CVE-2026-6460) that allows remote code execution (RCE) by an authenticated user with object creation permissions.

Understanding the CVE-2026-6460 Vulnerability

This is a "type confusion" flaw in composite types—structures that group fields of different data types. The mechanism allows a field's type to be altered while old values still remain stored in other parts of the server. When the server reads one of these old values as if it belonged to the new type, a confusion occurs that can be exploited to execute arbitrary code.

Exploitation occurs with the same privileges as the operating system user running the PostgreSQL process, which in typical environments corresponds to the "postgres" user or a dedicated service account. The base CVSS score for the vulnerability was rated at 8.8, indicating high risk.

Scope of Affected Versions

All releases prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable. This includes long-term support (LTS) versions still in use by many organizations.

Demonstrated Exploitation

Security researcher Mehmet Ince published a write-up this week detailing a functional exploit against PostgreSQL 18.6. The method consists of inserting a value into a table, altering the type of one of that value's fields, and then executing a query that forces the server to interpret the old value as belonging to the new type. The first step generates a crash that can be used to leak memory addresses; the final step, which executes code, was not publicly disclosed.

Ince states that the crash can be triggered by a login with the lowest privilege that still has the ability to create objects. The project's official advisory describes the attacker merely as someone who can create or modify objects, without specifying whether default privileges are sufficient to advance from a crash fault to code execution.

Illustration: Simplified diagram showing the exploitation flow of the type confusion vulnerability in PostgreSQL composite types.

Vendor and Authority Stances

The PostgreSQL Global Development Group has not yet recorded any exploitation incidents in production. The CVE record in the NVD indicates that observed exploitation is "none," as assessed by CISA. Red Hat, responsible for PostgreSQL packages across various Linux distributions, confirms that the attacker needs database credentials with permission to create or modify objects.

Other Fixes Included in the Release

In addition to CVE-2026-6460, the update fixes 51 additional flaws, 32 of which receive a CVSS score of 8.8—the highest in the batch. One vulnerability (CVE-2026-116322) allows an unauthenticated client to cause PostgreSQL 18 servers to restart, although it does not offer code execution.

Several issues also affect client tools: a malformed archive file can cause pg_restore to execute code as the invoking user, and a compromised source server can induce psql to execute code when processing restore scripts generated by pg_dump.

Recommendations for Administrators

• Immediately update the server to 18.7, 17.12, 16.16, 15.20, or 14.25, depending on the major version in use.

• Recompile or update all extensions written in C simultaneously with the server update. Extensions compiled against older versions may remain vulnerable.

• Verify the compatibility of recompiled extensions; RPM packages already require the new minor version.

• If PostgreSQL is managed by tools like Patroni, restart the service right after the update.

• Also update client tools (pg_dump, pg_restore, reindexdb, vacuumdb) on all machines that use them.

• Do not disable the new composite_type_mismatch setting; the documentation warns that this reduces security.

• There is no official workaround for servers that cannot be updated immediately.

• Note that PostgreSQL 14 has reached end-of-life; version 14.25 is the last release for this series.

• After the update, run the reindexing procedures described in the announcement and generate a full backup before resuming incremental backups.

Practical Impact for Brazilian Organizations

Companies operating PostgreSQL databases—whether on-premise or in managed services like Amazon Aurora, Azure Database for PostgreSQL, Google AlloyDB, or Supabase—must validate the patch status of these providers. Many of them have already received the patches, but confirmation varies. Failing to update may expose environments to code execution with service privileges, compromising sensitive data and allowing lateral movement.

Additionally, the need to recompile C extensions may cause temporary outages, requiring maintenance window planning. Organizations still using the 14 series should consider migrating to supported versions, as there will be no more security patches for this line.

Next Steps

In summary, the immediate priority is to apply official patches, validate extension integrity, and update client tools. Monitoring security bulletins from cloud providers and maintaining recent backups are essential complementary measures to reduce the risk of exploitation.

Frequently Asked Questions