CVE-2026-120142 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL mishandles anonymous RECORD types whose dropped columns differ in width or alignment, causing type confusion. An attacker who can create database objects can execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running PostgreSQL 17 or 18 before the 18.7 and 17.12 releases are exposed. The attacker must be able to create objects in the database, so databases where only trusted administrators can create objects carry less risk. PostgreSQL versions before 17 are not affected.
Not affected if managed-hosting, postgresql-below-17
Who cares database, postgresql, self-hosted
SELECT version(); or postgres --version18.7 or 17.1218.717.12Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.