---
id: "CVE-2026-116336"
page: "https://infrastack.ai/live/CVE-2026-116336"
kind: "vulnerability"
aliases: ["CVE-2026-116336"]
title: "PostgreSQL: REINDEX CONCURRENTLY lets an object creator run OS code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["fixed-version", "trusted-users-only"]
published_at: "2026-11-12T15:17:42+00:00"
first_seen_at: "2026-11-12T15:41:55+00:00"
updated_at: "2026-11-12T15:43:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116336", "first_seen_at": "2026-11-12T15:41:55+00:00"}]
exploit_sources: []
---

# PostgreSQL: REINDEX CONCURRENTLY lets an object creator run OS code

Link for people: https://infrastack.ai/live/CVE-2026-116336 (this .md is for agents)

A flaw in PostgreSQL's REINDEX CONCURRENTLY handling of dropped indexes lets a user who can create database objects run arbitrary code as the operating system user running the database. The sources say an attacker does this through an index expression that issues DROP INDEX.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `SELECT version();` in psql and compare against the fixed versions.
- Check whether untrusted users can create objects, such as indexes with expressions, in your databases.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116336

## From the sources

Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_