{"id":"CVE-2026-119922","kind":"vulnerability","aliases":["CVE-2026-119922"],"related":[],"title":"Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,…","description":"CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\n### CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\nBulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\n\nImpacted versions:\n\n- 1.2-1.5\n- 2.1-2.15\n- 3.1-3.12\n- 4.0-4.8\n- 5.1-5.4\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.\n\nReferences:\n\n- CVE-2026-119922\n- GHSA-fv9p-9rr9-fm35\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The Babelfish for PostgreSQL extension has an improper access control flaw that lets a remote authenticated user raise their privileges. The sources do not state what an elevated user can reach beyond that.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","babelfish","lab-disclosure","package","postgresql"],"not_affected_if":["babelfish-not-installed","version-outside-affected-ranges"],"how_to_check":"- Check the installed Babelfish extension version in the PostgreSQL database, for example with `SELECT extversion FROM pg_extension WHERE extname = 'babelfishpg_tds';` (unknown if the sources name a different check)\n- Compare the result against the affected ranges 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4","fix":"- Upgrade Babelfish for PostgreSQL extension to `4.10`, `5.6` or `6.1` (or later)\n- No workaround is given; upgrading is required","status":"open","published_at":"2026-11-03T19:17:57+00:00","first_seen_at":"2026-11-03T18:52:11+00:00","triaged_at":"2026-11-03T18:53:51+00:00","updated_at":"2026-11-03T20:33:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T18:53:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Babelfish for PostgreSQL extension to `4.10`, `5.6` or `6.1` (or later)\n- No workaround is given; upgrading is required","reach":"network","title":"Babelfish for PostgreSQL: improper access control lets users elevate privileges","impact":"medium","summary":"The Babelfish for PostgreSQL extension has an improper access control flaw that lets a remote authenticated user raise their privileges. The sources do not state what an elevated user can reach beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["babelfish","postgresql","aws"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user gains higher database privileges than granted","analyst_note":"","how_to_check":"- Check the installed Babelfish extension version in the PostgreSQL database, for example with `SELECT extversion FROM pg_extension WHERE extname = 'babelfishpg_tds';` (unknown if the sources name a different check)\n- Compare the result against the affected ranges 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-affected-ranges","babelfish-not-installed"],"who_is_affected":"Teams running the Babelfish for PostgreSQL extension, which lets PostgreSQL accept SQL Server workloads, in the affected version ranges. Exposure requires an authenticated remote user, so deployments that do not use Babelfish or restrict database accounts are less exposed. The sources do not say which deployment setups beyond the version ranges are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000787,"input_tokens":4694,"output_tokens":635,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1.5':12A,151C,191C '-119922':21A,24A,66C,74C,259C '-165':83C '-2.15':14A,153C,193C '-2026':20A,23A,65C,73C,258C '-3.12':16A,155C,195C '-4.8':18A,157C,197C '-5.4':159C,199C '/babelfish-for-postgresql/babelfish_extensions/.':139C '/informational':92C '00':97C '1.2':11A,150C,190C '10':96C '11/03/2026':95C '2.1':13A,152C,192C '2026':82C '3.1':15A,154C,194C '4.0':17A,156C,196C '4.10':183C,212C '5.1':158C,198C '5.6':184C,213C '6.1':185C,215C '9rr9':263C 'access':2A,40B,141C 'address':205C 'allow':161C 'applic':115C 'attent':91C 'authent':47B,163C 'aw':25B,84C,86C,135C 'aws-security@amazon.com':267C 'babelfish':6A,26B,33B,67C,75C,101C,116C,145C,178C,207C 'beyond':63B 'bulletin':80C 'code':229C 'concern':273C 'content':87C 'control':3A,41B,142C 'cve':19A,22A,64C,72C,257C 'date':94C 'deriv':228C 'descript':100C 'develop':118C 'disclosur':29B 'elev':59B,166C 'email':266C 'enabl':105C 'ensur':224C 'escal':71C,79C 'extens':9A,36B,104C,127C,148C,181C,210C 'fix':236C 'flaw':42B 'fm35':264C 'fork':226C 'fv9p':262C 'ghsa':261C 'ghsa-fv9p-9rr9-fm35':260C 'github.com':138C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':137C 'id':81C 'impact':188C 'import':89C 'improp':1A,39B,140C 'incorpor':233C 'issu':172C,202C,244C,255C 'lab':28B 'lab-disclosur':27B 'later':187C 'latest':221C 'let':44B 'maintain':133C 'may':160C 'model':128C 'modifi':113C 'new':235C 'opensourc':121C 'own':131C 'packag':30B 'patch':231C,248C 'pleas':265C 'postgresql':8A,31B,35B,69C,77C,103C,125C,147C,180C,209C 'privileg':51B,70C,78C,168C 'project':122C 'pst':99C 'public':93C 'question':271C 'rais':49B 'reach':62B 'recommend':174C,217C 'refer':256C 'remedi':170C,253C 'remot':46B,162C 'requir':90C,251C 'resolut':200C 'run':108C 'scope':85C 'secur':270C 'server':110C 'sourc':53B 'sql':109C 'state':56B 'type':88C 'upgrad':176C,218C,245C 'use':123C 'user':48B,60B,106C,164C 'version':10A,149C,182C,189C,211C,222C,249C 'without':112C 'workaround':237C,241C 'workload':111C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Babelfish for PostgreSQL extension, which lets PostgreSQL accept SQL Server workloads, in the affected version ranges. Exposure requires an authenticated remote user, so deployments that do not use Babelfish or restrict database accounts are less exposed. The sources do not say which deployment setups beyond the version ranges are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aws","babelfish","high","labdisclosure","package","postgresql"],"campaign_type":null,"first_public_at":"2026-11-03T18:19:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/#CVE-2026-119922","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T18:52:11+00:00","fetched_at":"2026-11-03T18:52:11+00:00","note":"AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation"},{"source":"nvd","external_id":"CVE-2026-119922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119922","severity":null,"published_at":"2026-11-03T19:17:57+00:00","modified_at":"2026-11-03T19:17:57+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:53+00:00","note":null}],"documents":[{"id":59788,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/","title":"AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\n### CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\nBulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\n\nImpacted versions:\n\n- 1.2-1.5\n- 2.1-2.15\n- 3.1-3.12\n- 4.0-4.8\n- 5.1-5.4\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.\n\nReferences:\n\n- CVE-2026-119922\n- GHSA-fv9p-9rr9-fm35\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-03T18:26:54+00:00","relation":"mentions","confidence":null,"note":null},{"id":60185,"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60186,"url":"https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T18:19:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}