{"id":"CVE-2026-120142","kind":"vulnerability","aliases":["CVE-2026-120142"],"related":[],"title":"PostgreSQL: type confusion in anonymous record types allows code execution","description":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected.","summary":"PostgreSQL mishandles anonymous RECORD types whose dropped columns differ in width or alignment, causing type confusion. An attacker who can create database objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","postgresql-below-17"],"how_to_check":"- Check the running server version with `SELECT version();` or `postgres --version`\n- Confirm the major version is 17 or 18 and the minor version is below `18.7` or `17.12`","fix":"- Upgrade PostgreSQL 18 to `18.7`\n- Upgrade PostgreSQL 17 to `17.12`","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:15+00:00","updated_at":"2026-11-12T15:43:15+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL 18 to `18.7`\n- Upgrade PostgreSQL 17 to `17.12`","reach":"network","title":"PostgreSQL: type confusion in anonymous record types allows code execution","impact":"high","summary":"PostgreSQL mishandles anonymous RECORD types whose dropped columns differ in width or alignment, causing type confusion. An attacker who can create database objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database operating system user on the server.","analyst_note":"","how_to_check":"- Check the running server version with `SELECT version();` or `postgres --version`\n- Confirm the major version is 17 or 18 and the minor version is below `18.7` or `17.12`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["postgresql-below-17","managed-hosting"],"who_is_affected":"Servers running PostgreSQL 17 or 18 before the 18.7 and 17.12 releases are exposed. The attacker must be able to create objects in the database, so databases where only trusted administrators can create objects carry less risk. PostgreSQL versions before 17 are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4586,"output_tokens":517,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120142':13A,16A '-18':101C '-2026':12A,15A '17':100C,114C '17.12':108C '18.7':106C 'affect':110C 'align':35B,96C 'allow':8A,65C 'anonym':5A,25B,62C 'arbitrari':48B,71C 'attack':40B 'attribut':86C 'caus':36B 'code':9A,49B,72C 'column':30B 'confus':3A,38B,59C 'creat':43B 'creator':68C 'cve':11A,14A 'databas':17B,44B,57B,80C 'differ':31B,93C 'drop':29B,85C 'execut':10A,47B,70C 'host':22B 'major':98C 'minor':102C 'mishandl':24B 'object':45B,67C 'oper':52B,75C 'posit':90C 'postgresql':1A,18B,23B,61C,105C,113C 'record':6A,26B,63C 'row':82C 'run':55B,78C 'runtim':19B 'self':21B 'self-host':20B 'system':53B,76C 'type':2A,7A,27B,37B,58C,64C,83C 'unaffect':116C 'user':54B,77C 'version':99C,103C,111C 'via':81C 'whose':28B 'width':33B,94C 'within':97C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL 17 or 18 before the 18.7 and 17.12 releases are exposed. The attacker must be able to create objects in the database, so databases where only trusted administrators can create objects carry less risk. PostgreSQL versions before 17 are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120142':13A,16A '-2026':12A,15A 'allow':8A 'anonym':5A 'code':9A 'confus':3A 'cve':11A,14A 'execut':10A 'postgresql':1A 'record':6A 'type':2A,7A","search_b":"'align':35B 'anonym':25B 'arbitrari':48B 'attack':40B 'caus':36B 'code':49B 'column':30B 'confus':38B 'creat':43B 'databas':17B,44B,57B 'differ':31B 'drop':29B 'execut':47B 'host':22B 'mishandl':24B 'object':45B 'oper':52B 'postgresql':18B,23B 'record':26B 'run':55B 'runtim':19B 'self':21B 'self-host':20B 'system':53B 'type':27B,37B 'user':54B 'whose':28B 'width':33B","search_c":"'-18':101C '17':100C,114C '17.12':108C '18.7':106C 'affect':110C 'align':96C 'allow':65C 'anonym':62C 'arbitrari':71C 'attribut':86C 'code':72C 'confus':59C 'creator':68C 'databas':80C 'differ':93C 'drop':85C 'execut':70C 'major':98C 'minor':102C 'object':67C 'oper':75C 'posit':90C 'postgresql':61C,105C,113C 'record':63C 'row':82C 'run':78C 'system':76C 'type':58C,64C,83C 'unaffect':116C 'user':77C 'version':99C,103C,111C 'via':81C 'width':94C 'within':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120142","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}