{"id":"CVE-2026-116329","kind":"vulnerability","aliases":["CVE-2026-116329"],"related":[],"title":"PostgreSQL: statistics import type confusion lets table maintainers run OS code","description":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected.","summary":"A type confusion bug in PostgreSQL's statistics import lets a table maintainer run arbitrary code as the operating system user that runs the database. Only PostgreSQL 18 minor versions before 18.7 are affected, and earlier major versions are not.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PostgreSQL","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["postgresql-18.7-or-later","postgresql-below-18"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` and check whether it reports a 18.x version below `18.7`\n- Check the running major version with `postgres --version`","fix":"- PostgreSQL 18: move to `18.7` or later","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:24+00:00","updated_at":"2026-11-12T15:43:24+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:43:24Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: move to `18.7` or later","reach":"local","title":"PostgreSQL: statistics import type confusion lets table maintainers run OS code","impact":"high","summary":"A type confusion bug in PostgreSQL's statistics import lets a table maintainer run arbitrary code as the operating system user that runs the database. Only PostgreSQL 18 minor versions before 18.7 are affected, and earlier major versions are not.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the database operating system user","analyst_note":"Confirm the fixed version and whether the PostgreSQL project advisory lists any workaround beyond upgrading to 18.7.","how_to_check":"- Run `psql -c \"SHOW server_version;\"` and check whether it reports a 18.x version below `18.7`\n- Check the running major version with `postgres --version`","plain_action":"","product_name":"PostgreSQL","needs_analyst":true,"not_affected_if":["postgresql-below-18","postgresql-18.7-or-later"],"who_is_affected":"Only PostgreSQL 18 servers running a minor version before 18.7 are affected, according to the NVD description. The attacker must be a table maintainer, so exposure depends on who can alter tables in the database. Earlier major versions are stated to be unaffected.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4569,"output_tokens":575,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116329':14A,17A '-2026':13A,16A '18':52B,99C,110C '18.7':56B,104C 'affect':58B,106C 'allow':69C 'arbitrari':39B,75C 'bug':28B 'code':11A,40B,76C 'confus':5A,27B,64C 'convers':91C 'cve':12A,15A 'data':88C 'databas':19B,49B,84C 'earlier':60B 'execut':74C 'host':24B 'import':3A,33B,68C,95C 'let':6A,34B 'maintain':8A,37B,72C 'major':61B,97C 'minor':53B,100C 'nest':86C 'oper':43B,79C 'os':10A 'postgresql':1A,18A,20B,30B,51B,66C,103C,109C 'run':9A,38B,47B,82C 'runtim':21B 'self':23B 'self-host':22B 'set':87C 'statist':2A,32B,67C 'system':44B,80C 'tabl':7A,36B,71C 'type':4A,26B,63C,89C 'unaffect':112C 'user':45B,81C 'valu':93C 'version':54B,62B,98C,101C,107C 'via':85C 'within':96C","nicknames":[],"mitigations":[],"who_affected":"Only PostgreSQL 18 servers running a minor version before 18.7 are affected, according to the NVD description. The attacker must be a table maintainer, so exposure depends on who can alter tables in the database. Earlier major versions are stated to be unaffected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["postgresql"],"ptokens":["postgresql"],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116329':14A,17A '-2026':13A,16A 'code':11A 'confus':5A 'cve':12A,15A 'import':3A 'let':6A 'maintain':8A 'os':10A 'postgresql':1A,18A 'run':9A 'statist':2A 'tabl':7A 'type':4A","search_b":"'18':52B '18.7':56B 'affect':58B 'arbitrari':39B 'bug':28B 'code':40B 'confus':27B 'databas':19B,49B 'earlier':60B 'host':24B 'import':33B 'let':34B 'maintain':37B 'major':61B 'minor':53B 'oper':43B 'postgresql':20B,30B,51B 'run':38B,47B 'runtim':21B 'self':23B 'self-host':22B 'statist':32B 'system':44B 'tabl':36B 'type':26B 'user':45B 'version':54B,62B","search_c":"'18':99C,110C '18.7':104C 'affect':106C 'allow':69C 'arbitrari':75C 'code':76C 'confus':64C 'convers':91C 'data':88C 'databas':84C 'execut':74C 'import':68C,95C 'maintain':72C 'major':97C 'minor':100C 'nest':86C 'oper':79C 'postgresql':66C,103C,109C 'run':82C 'set':87C 'statist':67C 'system':80C 'tabl':71C 'type':63C,89C 'unaffect':112C 'user':81C 'valu':93C 'version':98C,101C,107C 'via':85C 'within':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116329","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}