{"id":"CVE-2026-116331","kind":"vulnerability","aliases":["CVE-2026-116331"],"related":[],"title":"PostgreSQL: type confusion in min/max aggregates lets an object creator run code","description":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A flaw in how PostgreSQL's planner handles min/max aggregates lets a user who can create objects define an aggregate with a SORTOP option that makes the planner mix up input and result types. The attacker can then execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","only-trusted-object-creators"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether untrusted users have CREATE privilege on a schema or database, since creating an aggregate is required.","fix":"- Upgrade to `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` depending on the major version in use.","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:24+00:00","updated_at":"2026-11-12T15:43:24+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:43:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` depending on the major version in use.","reach":"network","title":"PostgreSQL: type confusion in min/max aggregates lets an object creator run code","impact":"high","summary":"A flaw in how PostgreSQL's planner handles min/max aggregates lets a user who can create objects define an aggregate with a SORTOP option that makes the planner mix up input and result types. The attacker can then execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"code runs as the database operating system user on the server","analyst_note":"Ensure managed-service and distribution-specific patch status is verified if relevant.','product_name':","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether untrusted users have CREATE privilege on a schema or database, since creating an aggregate is required.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","only-trusted-object-creators"],"who_is_affected":"PostgreSQL servers before the fixed versions are affected when an account that can create objects, such as a user with CREATE privilege, is untrusted or compromised. Servers where only trusted administrators can create objects have a much smaller exposure. Managed database services should be checked against their own patch notes.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4589,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116331':15A,18A '-2026':14A,17A '14.25':132C '15.20':130C '16.16':129C '17.12':128C '18.7':127C 'affect':134C 'aggreg':6A,34B,44B,79C,102C,112C 'allow':81C 'arbitrari':64B,87C 'attack':60B 'caus':106C 'code':12A,65B,88C 'confus':3A,75C 'creat':40B 'creator':10A,84C 'cve':13A,16A 'databas':19B,73B,96C 'defin':42B,101C 'differ':123C 'execut':63B,86C 'flaw':26B 'handl':32B 'host':24B 'input':55B,114C 'let':7A,35B 'make':50B 'min/max':5A,33B,78C 'mix':53B 'object':9A,41B,83C 'oper':68B,91C 'optim':80C 'option':48B,105C 'planner':31B,52B,108C 'postgresql':1A,20B,29B,77C,126C 'result':57B,116C 'run':11A,71B,94C 'runtim':21B 'self':23B 'self-host':22B 'sortop':47B,104C 'system':69B,92C 'treat':110C 'type':2A,58B,74C,120C 'user':37B,70B,93C,100C 'user-defin':99C 'version':124C 'via':97C 'whose':103C","nicknames":[],"mitigations":[],"who_affected":"PostgreSQL servers before the fixed versions are affected when an account that can create objects, such as a user with CREATE privilege, is untrusted or compromised. Servers where only trusted administrators can create objects have a much smaller exposure. Managed database services should be checked against their own patch notes.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116331':15A,18A '-2026':14A,17A 'aggreg':6A 'code':12A 'confus':3A 'creator':10A 'cve':13A,16A 'let':7A 'min/max':5A 'object':9A 'postgresql':1A 'run':11A 'type':2A","search_b":"'aggreg':34B,44B 'arbitrari':64B 'attack':60B 'code':65B 'creat':40B 'databas':19B,73B 'defin':42B 'execut':63B 'flaw':26B 'handl':32B 'host':24B 'input':55B 'let':35B 'make':50B 'min/max':33B 'mix':53B 'object':41B 'oper':68B 'option':48B 'planner':31B,52B 'postgresql':20B,29B 'result':57B 'run':71B 'runtim':21B 'self':23B 'self-host':22B 'sortop':47B 'system':69B 'type':58B 'user':37B,70B","search_c":"'14.25':132C '15.20':130C '16.16':129C '17.12':128C '18.7':127C 'affect':134C 'aggreg':79C,102C,112C 'allow':81C 'arbitrari':87C 'caus':106C 'code':88C 'confus':75C 'creator':84C 'databas':96C 'defin':101C 'differ':123C 'execut':86C 'input':114C 'min/max':78C 'object':83C 'oper':91C 'optim':80C 'option':105C 'planner':108C 'postgresql':77C,126C 'result':116C 'run':94C 'sortop':104C 'system':92C 'treat':110C 'type':74C,120C 'user':93C,100C 'user-defin':99C 'version':124C 'via':97C 'whose':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116331","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}