---
id: "CVE-2026-116331"
page: "https://infrastack.ai/live/CVE-2026-116331"
kind: "vulnerability"
aliases: ["CVE-2026-116331"]
title: "PostgreSQL: type confusion in min/max aggregates lets an object creator run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "only-trusted-object-creators"]
published_at: "2026-11-12T15:17:41+00:00"
first_seen_at: "2026-11-12T15:41:55+00:00"
updated_at: "2026-11-12T15:43:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116331", "first_seen_at": "2026-11-12T15:41:55+00:00"}]
exploit_sources: []
---

# PostgreSQL: type confusion in min/max aggregates lets an object creator run code

Link for people: https://infrastack.ai/live/CVE-2026-116331 (this .md is for agents)

A flaw in how PostgreSQL's planner handles min/max aggregates lets a user who can create objects define an aggregate with a SORTOP option that makes the planner mix up input and result types. The attacker can then execute arbitrary code as the operating system user running the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT version();` in psql and compare against the fixed versions below.
- Check whether untrusted users have CREATE privilege on a schema or database, since creating an aggregate is required.

## Fix

- Upgrade to `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` depending on the major version in use.

## Timeline

- 2026-11-12T15:41:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116331

## From the sources

Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_