{"id":"CVE-2026-116306","kind":"vulnerability","aliases":["CVE-2026-116306"],"related":[],"title":"PostgreSQL: composite-value type confusion lets an object creator run OS code","description":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A type confusion bug in PostgreSQL's composite-value field assignment lets a user who can create database objects change a composite type between deforming and reforming a value. The result is arbitrary code execution as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["patched-versions"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","triaged_at":"2026-11-12T15:43:39+00:00","updated_at":"2026-11-12T15:43:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:39Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: composite-value type confusion lets an object creator run OS code","impact":"high","summary":"A type confusion bug in PostgreSQL's composite-value field assignment lets a user who can create database objects change a composite type between deforming and reforming a value. The result is arbitrary code execution as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database operating system user on the server","analyst_note":"Check the PostgreSQL release notes and the NVD entry for the exact affected ranges and any mitigation before the fixed versions are applied.","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-versions"],"who_is_affected":"Any PostgreSQL server before the fixed versions is affected, since the flaw is in the core engine. The attacker must be able to create objects in the database, so exposure depends on who holds that privilege. Servers where only trusted administrators can create objects are at lower risk, but the sources do not say how common that setup is.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4559,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116306':16A,19A '-2026':15A,18A '14.25':114C '15.20':112C '16.16':111C '17.12':110C '18.7':109C 'affect':116C 'allow':79C 'arbitrari':59B,85C 'assign':37B,78C 'bug':29B 'chang':46B,96C 'code':13A,60B,86C 'composit':3A,34B,48B,75C,98C 'composite-valu':2A,33B,74C 'confus':6A,28B,71C 'creat':43B 'creator':10A,82C 'cve':14A,17A 'databas':20B,44B,69B,94C 'deform':51B,101C 'execut':61B,84C 'field':36B,77C 'host':25B 'let':7A,38B 'object':9A,45B,81C 'oper':64B,89C 'os':12A 'postgresql':1A,21B,31B,73C,108C 'reform':53B,103C 'result':57B 'run':11A,67B,92C 'runtim':22B 'self':24B 'self-host':23B 'system':65B,90C 'type':5A,27B,49B,70C,99C 'user':40B,66B,91C 'valu':4A,35B,55B,76C,105C 'version':106C 'via':95C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server before the fixed versions is affected, since the flaw is in the core engine. The attacker must be able to create objects in the database, so exposure depends on who holds that privilege. Servers where only trusted administrators can create objects are at lower risk, but the sources do not say how common that setup is.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116306':16A,19A '-2026':15A,18A 'code':13A 'composit':3A 'composite-valu':2A 'confus':6A 'creator':10A 'cve':14A,17A 'let':7A 'object':9A 'os':12A 'postgresql':1A 'run':11A 'type':5A 'valu':4A","search_b":"'arbitrari':59B 'assign':37B 'bug':29B 'chang':46B 'code':60B 'composit':34B,48B 'composite-valu':33B 'confus':28B 'creat':43B 'databas':20B,44B,69B 'deform':51B 'execut':61B 'field':36B 'host':25B 'let':38B 'object':45B 'oper':64B 'postgresql':21B,31B 'reform':53B 'result':57B 'run':67B 'runtim':22B 'self':24B 'self-host':23B 'system':65B 'type':27B,49B 'user':40B,66B 'valu':35B,55B","search_c":"'14.25':114C '15.20':112C '16.16':111C '17.12':110C '18.7':109C 'affect':116C 'allow':79C 'arbitrari':85C 'assign':78C 'chang':96C 'code':86C 'composit':75C,98C 'composite-valu':74C 'confus':71C 'creator':82C 'databas':94C 'deform':101C 'execut':84C 'field':77C 'object':81C 'oper':89C 'postgresql':73C,108C 'reform':103C 'run':92C 'system':90C 'type':70C,99C 'user':91C 'valu':76C,105C 'version':106C 'via':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116306","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116306","severity":null,"published_at":"2026-11-12T15:17:38+00:00","modified_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","fetched_at":"2026-11-12T15:41:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}