PostgreSQL has released security updates addressing 52 vulnerabilities, including a high-severity type confusion flaw that could allow an attacker with database object creation privileges to execute arbitrary code on the server.
Tracked as CVE-2026-6460, the vulnerability carries a CVSS score of 8.8 and affects multiple PostgreSQL versions.
The flaw affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25. According to the PostgreSQL Global Development Group, successful exploitation could allow an attacker to execute code with the privileges of the operating system account running the database service.
The vulnerability involves composite types, which allow PostgreSQL to store multiple named fields with different data types as a single value. Under certain conditions, an attacker can change the type of a field while older values remain stored elsewhere in the server. PostgreSQL could then incorrectly interpret an existing value using the updated type, creating an opportunity for memory corruption and potentially remote code execution.
The latest security update introduces additional version checks to detect when stored values no longer match their expected data types. These protections are documented in the project’s PostgreSQL release notes.
Security researcher Mehmet Ince demonstrated a working exploit against PostgreSQL 18.6 in a technical write-up published this week. His research explains how an attacker can prepare a query containing a value, modify the type of one of its fields, and execute the query to trigger the vulnerability.
The researcher also demonstrated that the technique could crash an unpatched server and leak memory addresses. However, his public write-up does not include the SQL statement used in the final stage to execute operating system commands.
Ince reported that he could trigger the initial crash using a database account with very limited privileges. However, the exact privileges required to achieve full code execution remain unclear. PostgreSQL’s security advisory describes the attacker as someone capable of creating objects, while Red Hat’s assessment says an attacker needs a database login with permission to create or modify objects. Neither assessment confirms whether default database privileges alone are sufficient to achieve remote code execution.
The researcher also adapted his exploit for managed PostgreSQL environments and privately shared proof-of-concept demonstrations with several service providers in August. These included Amazon Aurora and RDS, Microsoft Azure Database for PostgreSQL, Google AlloyDB, Supabase, Databricks, and Ubicloud. The public research does not establish the current patch status of each service.
The vulnerability also has a long history. Ince traced its roots to a PostgreSQL change introduced on May 5, 2004, which allowed users to change a column’s data type. His code execution technique also relies on a later change introduced on May 14, 2015.
Beyond CVE-2026-6460, the PostgreSQL security release addresses 51 additional vulnerabilities. The project assigned a CVSS score of 8.8 to 32 of the 52 flaws, making them the highest-severity issues in this release.
One of the other vulnerabilities, CVE-2026-116322, is particularly concerning because it can allow an unauthenticated remote client to trigger a restart of PostgreSQL 18 servers without requiring a login or user interaction.
Several additional security fixes affect PostgreSQL client utilities. A specially crafted archive could cause pg_restore to execute malicious code with the privileges of the user running the utility. Another issue involves a compromised source server manipulating a restore script generated through pg_dump’s tar output, potentially causing psql to execute unwanted commands.
PostgreSQL administrators are strongly advised to install the latest security updates for their respective major versions. The recommended releases are PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25.
However, updating the database server alone is not sufficient to provide complete protection against CVE-2026-6460. Administrators must also rebuild or update installed C-language extensions alongside the server. Extensions compiled against older PostgreSQL releases may continue to load, but they might not receive the security protections introduced in the latest updates. Some extensions may also require source-code changes before they can be rebuilt.
Administrators using PostgreSQL extensions from the project’s RPM repositories should pay particular attention to package compatibility, as the updated extension packages now require the corresponding new minor release. Extensions rebuilt for newer releases may also fail to load on older PostgreSQL servers.
Organizations running PostgreSQL outside its standard package service unit, including deployments managed through Patroni, should restart the database immediately after applying the updates. Administrators should also update client utilities such as pg_dump, pg_restore, reindexdb, and vacuumdb on every system where they are installed.
The PostgreSQL project has warned against using the new composite_type_mismatch setting to disable the additional checks, as doing so could introduce security risks. No workaround has been provided for systems that cannot install the updates.
PostgreSQL 14 users should also plan to migrate to a supported major version, as version 14.25 is its final release and the series has reached end of life.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
After installing the updates, administrators should follow the reindexing instructions provided in the official PostgreSQL release announcement. Organizations using incremental backups should also create a new full backup and use it as the foundation for subsequent incremental backups.
