{"id":"CVE-2026-116335","kind":"vulnerability","aliases":["CVE-2026-116335"],"related":[],"title":"PostgreSQL: operator link flaw lets a user run code as the database OS account","description":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL mishandles commutator and negator links between operators that have different result types or inconsistent reciprocal links, which is a type confusion bug. A user who can create database objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","only-trusted-roles-can-create-objects"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Confirm the running server is PostgreSQL before `18.7`, `17.12`, `16.16`, `15.20` or `14.25` on its release branch.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:20+00:00","updated_at":"2026-11-12T15:43:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:20Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: operator link flaw lets a user run code as the database OS account","impact":"high","summary":"PostgreSQL mishandles commutator and negator links between operators that have different result types or inconsistent reciprocal links, which is a type confusion bug. A user who can create database objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database server's operating system user.","analyst_note":"Sources list the fixed versions; no exploit details or mitigation beyond patching were provided.','product_name':","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Confirm the running server is PostgreSQL before `18.7`, `17.12`, `16.16`, `15.20` or `14.25` on its release branch.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","only-trusted-roles-can-create-objects"],"who_is_affected":"Any PostgreSQL server on the affected release branches is in scope, since the flaw is in the database engine itself. Exposure depends on who can create database objects such as operators, so servers where only trusted administrators hold that right carry less risk. Teams on managed PostgreSQL services should check with their provider for patch status.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4565,"output_tokens":622,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116335':17A,20A '-2026':16A,19A '14.25':114C '15.20':112C '16.16':111C '17.12':110C '18.7':109C 'account':14A 'affect':116C 'allow':78C 'arbitrari':59B,84C 'bug':49B 'code':9A,60B,85C 'commut':29B,74C 'confus':48B,70C 'creat':54B,102C 'creator':81C 'cve':15A,18A 'databas':12A,21B,55B,68B,93C 'differ':37B,98C 'execut':58B,83C 'flaw':4A 'host':26B 'inconsist':41B,103C 'let':5A 'link':3A,32B,43B,77C,95C,105C 'mishandl':28B 'negat':31B,76C 'object':56B,80C 'oper':2A,34B,63B,73C,88C,96C 'os':13A 'postgresql':1A,22B,27B,72C,108C 'reciproc':42B,104C 'result':38B,99C 'run':8A,66B,91C 'runtim':23B 'self':25B 'self-host':24B 'system':64B,89C 'type':39B,47B,69C,100C 'user':7A,51B,65B,90C 'version':106C 'via':94C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server on the affected release branches is in scope, since the flaw is in the database engine itself. Exposure depends on who can create database objects such as operators, so servers where only trusted administrators hold that right carry less risk. Teams on managed PostgreSQL services should check with their provider for patch status.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116335':17A,20A '-2026':16A,19A 'account':14A 'code':9A 'cve':15A,18A 'databas':12A 'flaw':4A 'let':5A 'link':3A 'oper':2A 'os':13A 'postgresql':1A 'run':8A 'user':7A","search_b":"'arbitrari':59B 'bug':49B 'code':60B 'commut':29B 'confus':48B 'creat':54B 'databas':21B,55B,68B 'differ':37B 'execut':58B 'host':26B 'inconsist':41B 'link':32B,43B 'mishandl':28B 'negat':31B 'object':56B 'oper':34B,63B 'postgresql':22B,27B 'reciproc':42B 'result':38B 'run':66B 'runtim':23B 'self':25B 'self-host':24B 'system':64B 'type':39B,47B 'user':51B,65B","search_c":"'14.25':114C '15.20':112C '16.16':111C '17.12':110C '18.7':109C 'affect':116C 'allow':78C 'arbitrari':84C 'code':85C 'commut':74C 'confus':70C 'creat':102C 'creator':81C 'databas':93C 'differ':98C 'execut':83C 'inconsist':103C 'link':77C,95C,105C 'negat':76C 'object':80C 'oper':73C,88C,96C 'postgresql':72C,108C 'reciproc':104C 'result':99C 'run':91C 'system':89C 'type':69C,100C 'user':90C 'version':106C 'via':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116335","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}