{"id":"CVE-2026-120148","kind":"vulnerability","aliases":["CVE-2026-120148"],"related":[],"title":"PostgreSQL: extended statistics type confusion lets an object creator run OS code","description":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL extended statistics mishandle an anonymous RECORD type in a statistics expression, a type confusion bug. A user who can create database objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","trusted-object-creators-only"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Check whether untrusted users can create objects, including extended statistics, in your databases.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:43+00:00","updated_at":"2026-11-12T15:43:43+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:43Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: extended statistics type confusion lets an object creator run OS code","impact":"high","summary":"PostgreSQL extended statistics mishandle an anonymous RECORD type in a statistics expression, a type confusion bug. A user who can create database objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"code runs as the database server's operating system user","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Check whether untrusted users can create objects, including extended statistics, in your databases.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","trusted-object-creators-only"],"who_is_affected":"Servers running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. The attack needs a database account that can create objects, so systems where only trusted administrators hold that right are lower risk. Managed database services are handled by their provider.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4577,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120148':15A,18A '-2026':14A,17A '14.25':113C '15.20':111C '16.16':110C '17.12':109C '18.7':108C 'affect':115C 'allow':66C 'anonym':30B,88C 'anoth':103C 'arbitrari':50B,72C 'backend':93C 'backend-loc':92C 'bug':40B 'code':12A,51B,73C 'confus':5A,39B,61C 'creat':45B 'creator':9A,69C 'cve':13A,16A 'databas':19B,46B,59B,81C 'denot':97C 'differ':99C 'execut':49B,71C 'express':36B,85C 'extend':2A,26B,64C 'host':24B 'identifi':96C 'let':6A 'local':94C 'mishandl':28B 'object':8A,47B,68C 'oper':54B,76C 'os':11A 'postgresql':1A,20B,25B,63C,107C 'record':31B,89C 'row':100C 'run':10A,57B,79C 'runtim':21B 'self':23B 'self-host':22B 'session':104C 'statist':3A,27B,35B,65C,84C 'system':55B,77C 'type':4A,32B,38B,60C,90C,95C,101C 'user':42B,56B,78C 'version':105C 'via':82C 'whose':91C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. The attack needs a database account that can create objects, so systems where only trusted administrators hold that right are lower risk. Managed database services are handled by their provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120148':15A,18A '-2026':14A,17A 'code':12A 'confus':5A 'creator':9A 'cve':13A,16A 'extend':2A 'let':6A 'object':8A 'os':11A 'postgresql':1A 'run':10A 'statist':3A 'type':4A","search_b":"'anonym':30B 'arbitrari':50B 'bug':40B 'code':51B 'confus':39B 'creat':45B 'databas':19B,46B,59B 'execut':49B 'express':36B 'extend':26B 'host':24B 'mishandl':28B 'object':47B 'oper':54B 'postgresql':20B,25B 'record':31B 'run':57B 'runtim':21B 'self':23B 'self-host':22B 'statist':27B,35B 'system':55B 'type':32B,38B 'user':42B,56B","search_c":"'14.25':113C '15.20':111C '16.16':110C '17.12':109C '18.7':108C 'affect':115C 'allow':66C 'anonym':88C 'anoth':103C 'arbitrari':72C 'backend':93C 'backend-loc':92C 'code':73C 'confus':61C 'creator':69C 'databas':81C 'denot':97C 'differ':99C 'execut':71C 'express':85C 'extend':64C 'identifi':96C 'local':94C 'object':68C 'oper':76C 'postgresql':63C,107C 'record':89C 'row':100C 'run':79C 'session':104C 'statist':65C,84C 'system':77C 'type':60C,90C,95C,101C 'user':78C 'version':105C 'via':82C 'whose':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120148","severity":null,"published_at":"2026-11-12T15:17:43+00:00","modified_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}