CVE-2026-120146 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's REASSIGN OWNED command does not check authorization the way the ALTER ... OWNER commands do. A role that has INHERIT but not SET can move objects to the role it was granted, and can reassign database ownership without CREATEDB.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted or managed PostgreSQL servers older than 18.7, 17.12, 16.16, 15.20 or 14.25. The exposure requires a role that has INHERIT membership without SET, so databases with a simple role layout are less exposed. Managed hosting providers patch on their own schedule.
Not affected if managed-hosting, simple-role-model
Who cares database-admins, postgresql, self-hosted
psql -c "SELECT version();" and compare the server version with the fixed releases below.\du in psql.18.7, 17.12, 16.16, 15.20 or 14.25 (the fixed release for your major version).Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.