CVE-2026-116335 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL mishandles commutator and negator links between operators that have different result types or inconsistent reciprocal links, which is a type confusion bug. A user who can create database objects can execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server on the affected release branches is in scope, since the flaw is in the database engine itself. Exposure depends on who can create database objects such as operators, so servers where only trusted administrators hold that right carry less risk. Teams on managed PostgreSQL services should check with their provider for patch status.
Not affected if managed-hosting, only-trusted-roles-can-create-objects
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare against the fixed versions listed below.18.7, 17.12, 16.16, 15.20 or 14.25 on its release branch.18.7Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
17.1216.1615.2014.25