{"id":"CVE-2026-116332","kind":"vulnerability","aliases":["CVE-2026-116332"],"related":[],"title":"PostgreSQL: use-after-free in portal setup lets object creators run code","description":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A use-after-free bug in PostgreSQL's portal setup lets a user who can create database objects run arbitrary code as the operating system user running the database. The flaw is triggered by user-defined code that closes the portal being prepared during planning or executor startup.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["fixed-version","only-trusted-roles-create-objects"],"how_to_check":"- Run `SELECT version();` in psql and compare the result with the fixed versions below.\n- Check the PostgreSQL major version with `postgres --version` on the database host.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:21+00:00","updated_at":"2026-11-12T15:43:21+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:43:21Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: use-after-free in portal setup lets object creators run code","impact":"high","summary":"A use-after-free bug in PostgreSQL's portal setup lets a user who can create database objects run arbitrary code as the operating system user running the database. The flaw is triggered by user-defined code that closes the portal being prepared during planning or executor startup.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs code as the database operating system user","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare the result with the fixed versions below.\n- Check the PostgreSQL major version with `postgres --version` on the database host.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","only-trusted-roles-create-objects"],"who_is_affected":"Any PostgreSQL server running a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker must be able to create database objects, and the bug is reached through user-defined code run during planning or executor startup. Servers where only trusted roles can create objects are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000739,"input_tokens":4563,"output_tokens":565,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116332':16A,19A '-2026':15A,18A '14.25':125C '15.20':123C '16.16':122C '17.12':121C '18.7':120C 'affect':127C 'allow':83C 'arbitrari':46B,89C 'bug':31B 'close':66B,111C 'code':13A,47B,64B,90C,104C 'creat':42B 'creator':11A,86C 'current':114C 'cve':14A,17A 'databas':20B,43B,55B,98C 'defin':63B,103C 'execut':88C 'executor':74B,108C 'flaw':57B 'free':5A,30B,78C 'host':25B 'let':9A,37B 'object':10A,44B,85C 'oper':50B,93C 'plan':72B,106C 'portal':7A,35B,68B,81C,113C 'postgresql':1A,21B,33B,80C,119C 'prepar':70B,116C 'run':12A,45B,53B,96C,100C 'runtim':22B 'self':24B 'self-host':23B 'setup':8A,36B,82C 'startup':75B,109C 'system':51B,94C 'trigger':59B 'use':3A,28B,76C 'use-after-fre':2A,27B 'user':39B,52B,62B,95C,102C 'user-defin':61B,101C 'version':117C 'via':99C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server running a version before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The attacker must be able to create database objects, and the bug is reached through user-defined code run during planning or executor startup. Servers where only trusted roles can create objects are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116332':16A,19A '-2026':15A,18A 'code':13A 'creator':11A 'cve':14A,17A 'free':5A 'let':9A 'object':10A 'portal':7A 'postgresql':1A 'run':12A 'setup':8A 'use':3A 'use-after-fre':2A","search_b":"'arbitrari':46B 'bug':31B 'close':66B 'code':47B,64B 'creat':42B 'databas':20B,43B,55B 'defin':63B 'executor':74B 'flaw':57B 'free':30B 'host':25B 'let':37B 'object':44B 'oper':50B 'plan':72B 'portal':35B,68B 'postgresql':21B,33B 'prepar':70B 'run':45B,53B 'runtim':22B 'self':24B 'self-host':23B 'setup':36B 'startup':75B 'system':51B 'trigger':59B 'use':28B 'use-after-fre':27B 'user':39B,52B,62B 'user-defin':61B","search_c":"'14.25':125C '15.20':123C '16.16':122C '17.12':121C '18.7':120C 'affect':127C 'allow':83C 'arbitrari':89C 'close':111C 'code':90C,104C 'creator':86C 'current':114C 'databas':98C 'defin':103C 'execut':88C 'executor':108C 'free':78C 'object':85C 'oper':93C 'plan':106C 'portal':81C,113C 'postgresql':80C,119C 'prepar':116C 'run':96C,100C 'setup':82C 'startup':109C 'system':94C 'use':76C 'user':95C,102C 'user-defin':101C 'version':117C 'via':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116332","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}