CVE-2026-116332 · Runtime
NO FIX YET · SEE WHAT TO DO
A use-after-free bug in PostgreSQL's portal setup lets a user who can create database objects run arbitrary code as the operating system user running the database. The flaw is triggered by user-defined code that closes the portal being prepared during planning or executor startup.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server running a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker must be able to create database objects, and the bug is reached through user-defined code run during planning or executor startup. Servers where only trusted roles can create objects are lower risk.
Not affected if fixed-version, only-trusted-roles-create-objects
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare the result with the fixed versions below.postgres --version on the database host.18.717.1216.1615.2014.25Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.