Type Confusion in PostgreSQL - CVE-2026-6460
Published: November 12, 2026
Vulnerability identifier: #VU166138
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-6460
CWE-ID: CWE-843
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to type confusion caused by inadequate tracking of typed values in the PostgreSQL core server when processing data definition statements. A remote user can use object-creation privileges to execute crafted statements, primarily ALTER ... SET DATA TYPE, or sequences such as ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN, to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-6460
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7