Untrusted search path in PostgreSQL - CVE-2026-14673
Published: August 15, 2026
Vulnerability identifier: #VU142633
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14673
CWE-ID: CWE-426
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary functions with the privileges of expression index owners.
The vulnerability exists due to improper control of search path in amcheck functions when invoking amcheck with a hostile search path. A remote privileged user can set a hostile search path before calling the amcheck function to execute arbitrary functions with the privileges of expression index owners.
Exploitation requires EXECUTE privilege on the amcheck function and affects expression indexes that depend on the search path.
Affected software
PostgreSQL
Debian Linux
postgresql-17 (Debian package)
Debian Linux
postgresql-17 (Debian package)
How to mitigate CVE-2026-14673
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.24, 15.19, 16.15, 18.5
postgresql-17 (Debian package) - update to 17.11-0+deb13u1
postgresql-17 (Debian package) - update to 17.11-0+deb13u1