{"id":"CVE-2026-120141","kind":"vulnerability","aliases":["CVE-2026-120141"],"related":[],"title":"PostgreSQL: type confusion in set-returning functions lets a database user run code","description":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types.  json_populate_recordset() is one affected function.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A flaw in PostgreSQL's materialized set-returning functions, such as json_populate_recordset(), causes a type confusion when rows with different dynamic RECORD return types are returned. A database user with query access can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["patched-version","trusted-users-only"],"how_to_check":"- Run `SELECT version();` in psql and compare the server version against the fixed releases.\n- Check whether the server runs a PostgreSQL major version 14, 15, 16, 17 or 18 below the fixed releases listed in Fix.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:16+00:00","updated_at":"2026-11-12T15:43:16+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:16Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: type confusion in set-returning functions lets a database user run code","impact":"high","summary":"A flaw in PostgreSQL's materialized set-returning functions, such as json_populate_recordset(), causes a type confusion when rows with different dynamic RECORD return types are returned. A database user with query access can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Database user runs arbitrary code as the database operating system user.","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare the server version against the fixed releases.\n- Check whether the server runs a PostgreSQL major version 14, 15, 16, 17 or 18 below the fixed releases listed in Fix.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","trusted-users-only"],"who_is_affected":"Any PostgreSQL server before the fixed releases is affected, and the risk is highest where untrusted or low-privilege database users can run queries that call functions such as json_populate_recordset(). Servers where only trusted administrators have database login can deprioritise it, though they should still upgrade. The sources do not state any non-default configuration that is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4574,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120141':17A,20A '-2026':16A,19A '14.25':123C '15.20':121C '16.16':120C '17.12':119C '18.7':118C 'access':61B 'affect':113C,125C 'allow':83C 'arbitrari':64B,89C 'caus':42B 'code':14A,65B,90C 'confus':3A,45B,75C 'cve':15A,18A 'databas':11A,21B,57B,73B,85C,98C 'differ':49B,103C 'dynam':50B,104C 'execut':63B,88C 'flaw':28B 'function':8A,36B,82C,114C 'host':26B 'json':39B,108C 'let':9A 'materi':32B,78C 'one':112C 'oper':68B,93C 'popul':40B,109C 'postgresql':1A,22B,30B,77C,117C 'queri':60B 'record':51B,105C 'recordset':41B,110C 'return':7A,35B,52B,55B,81C,100C,106C 'row':47B,101C 'run':13A,71B,96C 'runtim':23B 'self':25B 'self-host':24B 'set':6A,34B,80C 'set-return':5A,33B,79C 'system':69B,94C 'type':2A,44B,53B,74C,107C 'user':12A,58B,70B,86C,95C 'version':115C 'via':99C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server before the fixed releases is affected, and the risk is highest where untrusted or low-privilege database users can run queries that call functions such as json_populate_recordset(). Servers where only trusted administrators have database login can deprioritise it, though they should still upgrade. The sources do not state any non-default configuration that is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120141':17A,20A '-2026':16A,19A 'code':14A 'confus':3A 'cve':15A,18A 'databas':11A 'function':8A 'let':9A 'postgresql':1A 'return':7A 'run':13A 'set':6A 'set-return':5A 'type':2A 'user':12A","search_b":"'access':61B 'arbitrari':64B 'caus':42B 'code':65B 'confus':45B 'databas':21B,57B,73B 'differ':49B 'dynam':50B 'execut':63B 'flaw':28B 'function':36B 'host':26B 'json':39B 'materi':32B 'oper':68B 'popul':40B 'postgresql':22B,30B 'queri':60B 'record':51B 'recordset':41B 'return':35B,52B,55B 'row':47B 'run':71B 'runtim':23B 'self':25B 'self-host':24B 'set':34B 'set-return':33B 'system':69B 'type':44B,53B 'user':58B,70B","search_c":"'14.25':123C '15.20':121C '16.16':120C '17.12':119C '18.7':118C 'affect':113C,125C 'allow':83C 'arbitrari':89C 'code':90C 'confus':75C 'databas':85C,98C 'differ':103C 'dynam':104C 'execut':88C 'function':82C,114C 'json':108C 'materi':78C 'one':112C 'oper':93C 'popul':109C 'postgresql':77C,117C 'record':105C 'recordset':110C 'return':81C,100C,106C 'row':101C 'run':96C 'set':80C 'set-return':79C 'system':94C 'type':74C,107C 'user':86C,95C 'version':115C 'via':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120141","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}