CVE-2026-116316 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL does not fully protect an alternate code path in security-restricted operations, so a user who creates a domain, enum, or range type in a pg_temp schema can run arbitrary SQL as whoever triggers that operation. The victim session must later run a query with an unqualified type name, such as SELECT '1'::bigint, and autovacuum and other common background users are not affected.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running PostgreSQL before 18.7, 17.12, 16.16, 15.20, or 14.25 where users other than trusted administrators can connect and create objects. The victim must run a query with an unqualified type name in a session, so ordinary background jobs such as autovacuum are not exposed. Teams on managed PostgreSQL services should check the provider's patch notes.
Not affected if managed-hosting, patched-version, trusted-users-only
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare against the fixed versions below.18.717.1216.1615.2014.25Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.