Live › vulnerability › CVE-2026-119922
The Babelfish for PostgreSQL extension has an improper access control flaw that lets a remote authenticated user raise their privileges. The sources do not state what an elevated user can reach beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:52 UTC, 1h before NVD. All times on this page are UTC.
Teams running the Babelfish for PostgreSQL extension, which lets PostgreSQL accept SQL Server workloads, in the affected version ranges. Exposure requires an authenticated remote user, so deployments that do not use Babelfish or restrict database accounts are less exposed. The sources do not say which deployment setups beyond the version ranges are affected.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'babelfishpg_tds'; (unknown if the sources name a different check)4.10, 5.6 or 6.1 (or later)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation
Bulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST
Description:
Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/.
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Impacted versions:
Resolution:
This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-119922")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.