Insecure DLL loading in PostgreSQL - CVE-2026-6467
Published: November 12, 2026
Vulnerability identifier: #VU166137
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6467
CWE-ID: CWE-427
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary code as the PostgreSQL bootstrap superuser.
The vulnerability exists due to an uncontrolled search path element in PostgreSQL CREATE EXTENSION and ALTER EXTENSION when resolving objects in trusted-extension scripts. A remote privileged user can use database-level CREATE privilege with ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user" to cause a trusted-extension script to locate the wrong object and execute arbitrary SQL as the bootstrap superuser.
Affected software
PostgreSQL
How to mitigate CVE-2026-6467
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7