{"id":"CVE-2026-120144","kind":"vulnerability","aliases":["CVE-2026-120144"],"related":[],"title":"PostgreSQL: type-cache bug lets an object creator run OS commands","description":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected.","summary":"PostgreSQL mishandles a composite type change while its type-cache entry is being populated, causing type confusion. A user who can create database objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["patched-18.7-or-later","postgresql-below-18"],"how_to_check":"- Run `psql -c 'SHOW server_version;'` and confirm the version is inside major 18 and below `18.7`\n- Confirm the running major version with `postgres --version`","fix":"- PostgreSQL 18: upgrade to `18.7` or later","status":"open","published_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:13+00:00","updated_at":"2026-11-12T15:43:13+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:13Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: upgrade to `18.7` or later","reach":"local","title":"PostgreSQL: type-cache bug lets an object creator run OS commands","impact":"high","summary":"PostgreSQL mishandles a composite type change while its type-cache entry is being populated, causing type confusion. A user who can create database objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database operating system user on the server","analyst_note":"","how_to_check":"- Run `psql -c 'SHOW server_version;'` and confirm the version is inside major 18 and below `18.7`\n- Confirm the running major version with `postgres --version`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["postgresql-below-18","patched-18.7-or-later"],"who_is_affected":"Servers running PostgreSQL 18 with a minor version before 18.7 are affected. Any role that can create database objects such as composite types could exploit it, so limit who holds that privilege. Versions before PostgreSQL 18 are unaffected according to the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4573,"output_tokens":486,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120144':15A,18A '-2026':14A,17A '18':102C,113C '18.7':107C 'affect':109C 'allow':71C 'arbitrari':52B,77C 'bug':5A 'cach':4A,35B,69C,94C 'caus':40B 'chang':30B,91C 'code':53B,78C 'command':12A 'composit':28B,89C 'confus':42B,63C 'creat':47B 'creator':9A,74C 'cve':13A,16A 'databas':19B,48B,61B,86C 'entri':36B,95C 'execut':51B,76C 'host':24B 'incomplet':65C 'invalid':70C 'let':6A 'major':100C 'minor':103C 'mishandl':26B 'object':8A,49B,73C 'oper':56B,81C 'os':11A 'popul':39B,98C 'postgresql':1A,20B,25B,66C,106C,112C 'run':10A,59B,84C 'runtim':21B 'self':23B 'self-host':22B 'system':57B,82C 'type':3A,29B,34B,41B,62C,68C,90C 'type-cach':2A,33B,67C 'unaffect':115C 'user':44B,58B,83C 'version':101C,104C,110C 'via':87C 'within':99C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL 18 with a minor version before 18.7 are affected. Any role that can create database objects such as composite types could exploit it, so limit who holds that privilege. Versions before PostgreSQL 18 are unaffected according to the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120144':15A,18A '-2026':14A,17A 'bug':5A 'cach':4A 'command':12A 'creator':9A 'cve':13A,16A 'let':6A 'object':8A 'os':11A 'postgresql':1A 'run':10A 'type':3A 'type-cach':2A","search_b":"'arbitrari':52B 'cach':35B 'caus':40B 'chang':30B 'code':53B 'composit':28B 'confus':42B 'creat':47B 'databas':19B,48B,61B 'entri':36B 'execut':51B 'host':24B 'mishandl':26B 'object':49B 'oper':56B 'popul':39B 'postgresql':20B,25B 'run':59B 'runtim':21B 'self':23B 'self-host':22B 'system':57B 'type':29B,34B,41B 'type-cach':33B 'user':44B,58B","search_c":"'18':102C,113C '18.7':107C 'affect':109C 'allow':71C 'arbitrari':77C 'cach':69C,94C 'chang':91C 'code':78C 'composit':89C 'confus':63C 'creator':74C 'databas':86C 'entri':95C 'execut':76C 'incomplet':65C 'invalid':70C 'major':100C 'minor':103C 'object':73C 'oper':81C 'popul':98C 'postgresql':66C,106C,112C 'run':84C 'system':82C 'type':62C,68C,90C 'type-cach':67C 'unaffect':115C 'user':83C 'version':101C,104C,110C 'via':87C 'within':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120144","severity":null,"published_at":"2026-11-12T15:17:42+00:00","modified_at":"2026-11-12T15:17:42+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}