PostgreSQL Patches Critical Flaw Enabling Remote Code Execution

The PostgreSQL Global Development Group has released security updates to address 52 vulnerabilities, including a high-severity flaw that allows authenticated users to execute arbitrary code on a server.

The most critical vulnerability, tracked as CVE-2026-6460, has been assigned a CVSS score of 8.8. The flaw involves a type confusion issue within composite types—data structures built from named fields. An attacker can change a field’s type while older values of that type are still held in other parts of the server, causing the server to read old values as if they possessed the new type.

This vulnerability enables remote code execution (RCE) for any database user with the ability to create objects. Any code executed via this method carries the same permissions as the operating system user running the PostgreSQL service.

Technical Origins and Exploitation

Security researcher Mehmet Ince discovered the flaw and demonstrated a working exploit on PostgreSQL 18.6. Ince traced the root cause of the issue to May 2004, when PostgreSQL introduced the capability to change a column’s type. His demonstration showed that a lowest-privileged login role could trigger a server crash and leak memory addresses by preparing specific queries and altering field types mid-process.

While Ince’s technical write-up includes the steps to crash a server and leak memory, the specific SQL required to complete the final stage of remote code execution has not been made public.

The PostgreSQL Global Development Group has not reported any instances of this flaw being exploited in the wild, and CISA’s assessment currently lists exploitation as none.

Affected Versions and Managed Services

The vulnerability affects all versions of PostgreSQL prior to the following releases:

• 18.7
• 17.12
• 16.16
• 15.20
• 14.25

Notably, PostgreSQL 14 has reached end-of-life, making version 14.25 its final release. Managed service providers, including AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud, were privately notified of the flaw in August to facilitate patching.

Beyond the RCE flaw, the update addresses 51 other security issues. These include a vulnerability (CVE-2026-116322) that allows an unauthenticated client to trigger a restart of PostgreSQL 18 servers, and flaws in client tools like pg_dump and pg_restore that could lead to code execution via crafted archives or compromised source servers.

Required Remediation Steps

Administrators must update their servers to the latest minor releases matching their major version. However, updating the core software is not sufficient for full protection against CVE-2026-6460.

To ensure complete security, administrators must also:

• Rebuild or update every C-language extension installed on the server. Extensions built against older releases may remain vulnerable.
• Update client tools such as pg_dump, pg_restore, reindexdb, and vacuumdb on all machines where they are used.
• Restart the PostgreSQL service immediately after the update, particularly if the service is managed outside its own service unit, such as under Patroni.
• Perform reindexing as specified in the project’s official release announcement.

For those using incremental backups, the project recommends taking a new full backup to ensure all subsequent incremental backups are based on a secure state.