{"id":"CVE-2026-116336","kind":"vulnerability","aliases":["CVE-2026-116336"],"related":[],"title":"PostgreSQL: REINDEX CONCURRENTLY lets an object creator run OS code","description":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A flaw in PostgreSQL's REINDEX CONCURRENTLY handling of dropped indexes lets a user who can create database objects run arbitrary code as the operating system user running the database. The sources say an attacker does this through an index expression that issues DROP INDEX.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["fixed-version","trusted-users-only"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions.\n- Check whether untrusted users can create objects, such as indexes with expressions, in your databases.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:43:19+00:00","updated_at":"2026-11-12T15:43:19+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:19Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"unknown","title":"PostgreSQL: REINDEX CONCURRENTLY lets an object creator run OS code","impact":"high","summary":"A flaw in PostgreSQL's REINDEX CONCURRENTLY handling of dropped indexes lets a user who can create database objects run arbitrary code as the operating system user running the database. The sources say an attacker does this through an index expression that issues DROP INDEX.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database operating system user on the server.","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions.\n- Check whether untrusted users can create objects, such as indexes with expressions, in your databases.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","trusted-users-only"],"who_is_affected":"Versions of PostgreSQL before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected. The attacker needs to be able to create objects in the database, so databases with only trusted users are at lower risk. Look at any server running PostgreSQL that accepts object creation from less-trusted accounts.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000748,"input_tokens":4576,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116336':13A,16A '-2026':12A,15A '14.25':109C '15.20':107C '16.16':106C '17.12':105C '18.7':104C 'affect':111C 'allow':77C 'arbitrari':43B,83C 'attack':57B 'code':10A,44B,84C 'concurr':3A,29B,76C 'creat':39B 'creator':7A,80C 'cve':11A,14A 'databas':17B,40B,52B,92C 'drop':32B,66B,71C,99C 'execut':82C 'express':63B,96C 'flaw':24B 'handl':30B 'host':22B 'index':33B,62B,67B,72C,95C,100C 'issu':65B,98C 'let':4A,34B 'object':6A,41B,79C 'oper':47B,68C,87C 'os':9A 'postgresql':1A,18B,26B,74C,103C 'reindex':2A,28B,75C 'run':8A,42B,50B,90C 'runtim':19B 'say':55B 'self':21B 'self-host':20B 'sourc':54B 'system':48B,88C 'user':36B,49B,89C 'version':101C 'via':93C","nicknames":[],"mitigations":[],"who_affected":"Versions of PostgreSQL before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected. The attacker needs to be able to create objects in the database, so databases with only trusted users are at lower risk. Look at any server running PostgreSQL that accepts object creation from less-trusted accounts.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116336':13A,16A '-2026':12A,15A 'code':10A 'concurr':3A 'creator':7A 'cve':11A,14A 'let':4A 'object':6A 'os':9A 'postgresql':1A 'reindex':2A 'run':8A","search_b":"'arbitrari':43B 'attack':57B 'code':44B 'concurr':29B 'creat':39B 'databas':17B,40B,52B 'drop':32B,66B 'express':63B 'flaw':24B 'handl':30B 'host':22B 'index':33B,62B,67B 'issu':65B 'let':34B 'object':41B 'oper':47B 'postgresql':18B,26B 'reindex':28B 'run':42B,50B 'runtim':19B 'say':55B 'self':21B 'self-host':20B 'sourc':54B 'system':48B 'user':36B,49B","search_c":"'14.25':109C '15.20':107C '16.16':106C '17.12':105C '18.7':104C 'affect':111C 'allow':77C 'arbitrari':83C 'code':84C 'concurr':76C 'creator':80C 'databas':92C 'drop':71C,99C 'execut':82C 'express':96C 'index':72C,95C,100C 'issu':98C 'object':79C 'oper':68C,87C 'postgresql':74C,103C 'reindex':75C 'run':90C 'system':88C 'user':89C 'version':101C 'via':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116336","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}