{"id":"CVE-2026-120143","kind":"vulnerability","aliases":["CVE-2026-120143"],"related":[],"title":"PostgreSQL: trigger functions let an object creator run OS code","description":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A use-after-free bug in PostgreSQL trigger functions lets a user who can create database objects run arbitrary code as the operating system user running the database. The attack uses a cursor over a transition table.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["only-trusted-object-creators","patched-version"],"how_to_check":"- Check the server version with `SELECT version();` or `postgres --version`\n- Compare the result against the fixed releases listed in the fix section\n- Confirm who can create objects such as functions and triggers in your databases","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:15+00:00","updated_at":"2026-11-12T15:43:15+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:15Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: trigger functions let an object creator run OS code","impact":"high","summary":"A use-after-free bug in PostgreSQL trigger functions lets a user who can create database objects run arbitrary code as the operating system user running the database. The attack uses a cursor over a transition table.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the database operating system user","analyst_note":"","how_to_check":"- Check the server version with `SELECT version();` or `postgres --version`\n- Compare the result against the fixed releases listed in the fix section\n- Confirm who can create objects such as functions and triggers in your databases","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","only-trusted-object-creators"],"who_is_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The exposure requires an account that can create database objects, since the attacker must create a trigger function that uses a cursor over a transition table. Deployments where only trusted administrators can create objects are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4547,"output_tokens":560,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120143':13A,16A '-2026':12A,15A '14.25':99C '15.20':97C '16.16':96C '17.12':95C '18.7':94C 'affect':101C 'allow':68C 'arbitrari':42B,74C 'attack':53B 'bug':28B 'code':10A,43B,75C 'creat':38B 'creator':7A,71C 'cursor':56B,86C 'cve':11A,14A 'databas':17B,39B,51B,83C 'execut':73C 'free':27B,63C 'function':3A,32B,67C 'host':22B 'let':4A,33B 'object':6A,40B,70C 'oper':46B,78C 'os':9A 'postgresql':1A,18B,30B,65C,93C 'run':8A,41B,49B,81C 'runtim':19B 'self':21B 'self-host':20B 'system':47B,79C 'tabl':60B,90C 'transit':59B,89C 'trigger':2A,31B,66C 'use':25B,54B,61C 'use-after-fre':24B 'user':35B,48B,80C 'version':91C 'via':84C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The exposure requires an account that can create database objects, since the attacker must create a trigger function that uses a cursor over a transition table. Deployments where only trusted administrators can create objects are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120143':13A,16A '-2026':12A,15A 'code':10A 'creator':7A 'cve':11A,14A 'function':3A 'let':4A 'object':6A 'os':9A 'postgresql':1A 'run':8A 'trigger':2A","search_b":"'arbitrari':42B 'attack':53B 'bug':28B 'code':43B 'creat':38B 'cursor':56B 'databas':17B,39B,51B 'free':27B 'function':32B 'host':22B 'let':33B 'object':40B 'oper':46B 'postgresql':18B,30B 'run':41B,49B 'runtim':19B 'self':21B 'self-host':20B 'system':47B 'tabl':60B 'transit':59B 'trigger':31B 'use':25B,54B 'use-after-fre':24B 'user':35B,48B","search_c":"'14.25':99C '15.20':97C '16.16':96C '17.12':95C '18.7':94C 'affect':101C 'allow':68C 'arbitrari':74C 'code':75C 'creator':71C 'cursor':86C 'databas':83C 'execut':73C 'free':63C 'function':67C 'object':70C 'oper':78C 'postgresql':65C,93C 'run':81C 'system':79C 'tabl':90C 'transit':89C 'trigger':66C 'use':61C 'user':80C 'version':91C 'via':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120143","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}