---
id: "CVE-2026-116335"
page: "https://infrastack.ai/live/CVE-2026-116335"
kind: "vulnerability"
aliases: ["CVE-2026-116335"]
title: "PostgreSQL: operator link flaw lets a user run code as the database OS account"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "only-trusted-roles-can-create-objects"]
published_at: "2026-11-12T15:17:42+00:00"
first_seen_at: "2026-11-12T15:41:55+00:00"
updated_at: "2026-11-12T15:43:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116335", "first_seen_at": "2026-11-12T15:41:55+00:00"}]
exploit_sources: []
---

# PostgreSQL: operator link flaw lets a user run code as the database OS account

Link for people: https://infrastack.ai/live/CVE-2026-116335 (this .md is for agents)

PostgreSQL mishandles commutator and negator links between operators that have different result types or inconsistent reciprocal links, which is a type confusion bug. A user who can create database objects can execute arbitrary code as the operating system user running the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT version();` in psql and compare against the fixed versions listed below.
- Confirm the running server is PostgreSQL before `18.7`, `17.12`, `16.16`, `15.20` or `14.25` on its release branch.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116335

## From the sources

Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_