---
id: "CVE-2026-119922"
kind: "vulnerability"
aliases: ["CVE-2026-119922"]
title: "Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,\u2026"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws", "babelfish", "lab-disclosure", "package", "postgresql"]
not_affected_if: ["babelfish-not-installed", "version-outside-affected-ranges"]
published_at: "2026-11-03T19:17:57+00:00"
first_seen_at: "2026-11-03T18:52:11+00:00"
updated_at: "2026-11-03T20:33:39+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/", "first_seen_at": "2026-11-03T18:52:11+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119922", "first_seen_at": "2026-11-03T19:44:52+00:00"}]
---

# Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,…

The Babelfish for PostgreSQL extension has an improper access control flaw that lets a remote authenticated user raise their privileges. The sources do not state what an elevated user can reach beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Babelfish extension version in the PostgreSQL database, for example with `SELECT extversion FROM pg_extension WHERE extname = 'babelfishpg_tds';` (unknown if the sources name a different check)
- Compare the result against the affected ranges 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4

## Fix

- Upgrade Babelfish for PostgreSQL extension to `4.10`, `5.6` or `6.1` (or later)
- No workaround is given; upgrading is required

## Timeline

- 2026-11-03T18:52:11+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/ — AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation
- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119922

## Documents

- [advisory] Vendor advisory: github.com https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35
- [fix] Release notes: github.com https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4
- [mentions] AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/

## From the sources

CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation

### CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation

Bulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST

Description:

Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/. 

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.

Impacted versions:

- 1.2-1.5
- 2.1-2.15
- 3.1-3.12
- 4.0-4.8
- 5.1-5.4

Resolution:

This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.

References:

- CVE-2026-119922
- GHSA-fv9p-9rr9-fm35

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_