Who is not affected by CVE-2026-120143?

Q: Who is not affected by CVE-2026-120143?

Not affected if: only-trusted-object-creators, patched-version.

HIGH8.8CVSS · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

NO KNOWN
EXPLOIT

CVE-2026-120143 · Runtime

PostgreSQL: trigger functions let an object creator run OS code

NO FIX YET · SEE WHAT TO DO

A use-after-free bug in PostgreSQL trigger functions lets a user who can create database objects run arbitrary code as the operating system user running the database. The attack uses a cursor over a transition table.

first public Nov 12, 2026 · 1 source

Check it with your coding agent

It reads this page and tells you if your code or app is affected.

Claude CodeCodexCursorAdd to your agent

01 · Who is affected

Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The exposure requires an account that can create database objects, since the attacker must create a trigger function that uses a cursor over a transition table. Deployments where only trusted administrators can create objects are lower risk.

Not affected if only-trusted-object-creators, patched-version

Who cares database, postgresql, self-hosted

02 · How to check

Check the server version with SELECT version(); or postgres --version
Compare the result against the fixed releases listed in the fix section
Confirm who can create objects such as functions and triggers in your databases

03 · The fix

PostgreSQL 18.7
PostgreSQL 17.12
PostgreSQL 16.16
PostgreSQL 15.20

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 12, 2026

What the sources say, verbatim

265 characters

Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.