---
id: "CVE-2026-116329"
page: "https://infrastack.ai/live/CVE-2026-116329"
kind: "vulnerability"
aliases: ["CVE-2026-116329"]
title: "PostgreSQL: statistics import type confusion lets table maintainers run OS code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "PostgreSQL", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["postgresql-18.7-or-later", "postgresql-below-18"]
published_at: "2026-11-12T15:17:41+00:00"
first_seen_at: "2026-11-12T15:41:55+00:00"
updated_at: "2026-11-12T15:43:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116329", "first_seen_at": "2026-11-12T15:41:55+00:00"}]
exploit_sources: []
---

# PostgreSQL: statistics import type confusion lets table maintainers run OS code

Link for people: https://infrastack.ai/live/CVE-2026-116329 (this .md is for agents)

A type confusion bug in PostgreSQL's statistics import lets a table maintainer run arbitrary code as the operating system user that runs the database. Only PostgreSQL 18 minor versions before 18.7 are affected, and earlier major versions are not.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:PostgreSQL affected range not listed fixed no fixed version listed

## How to check

- Run `psql -c "SHOW server_version;"` and check whether it reports a 18.x version below `18.7`
- Check the running major version with `postgres --version`

## Fix

- PostgreSQL 18: move to `18.7` or later

## Timeline

- 2026-11-12T15:41:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116329

## From the sources

Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_