CVE-2026-116303 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL does not check EXECUTE privilege when certain type conversions (foreign keys, to_json() and others) invoke a cast function. A database user without EXECUTE rights on that cast function can still trigger it, which may expose data in rare cases.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. Exploitation requires a database user who has a login and must locate access-restricted cast functions with confidentiality impact, which the sources say are few or none in practice.
Not affected if no-restricted-cast-functions, patched-version
Who cares database, postgresql, self-hosted
SELECT version(); and compare it to the fixed versions below.18.717.1216.1615.2014.25Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.