{"id":"CVE-2026-120149","kind":"vulnerability","aliases":["CVE-2026-120149"],"related":[],"title":"PostgreSQL: foreign batch inserts overflow heap, letting a foreign server run code","description":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied.  postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's postgres_fdw extension mishandles the row count returned by a remote server during batch inserts, causing a heap buffer overflow. A malicious or compromised foreign server can use this to execute arbitrary code on the PostgreSQL instance that connects to it.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgres_fdw","postgresql","runtime","self-hosted"],"not_affected_if":["fixed-version","no-postgres-fdw"],"how_to_check":"- Check the server version with `psql -c \"SHOW server_version;\"`, then compare against the fixed versions below.\n- Check whether the postgres_fdw extension is installed with `psql -c \"\\dx postgres_fdw\"`.","fix":"- PostgreSQL 18: move to `18.7`\n- PostgreSQL 17: move to `17.12`\n- PostgreSQL 16: move to `16.16`\n- PostgreSQL 15: move to `15.20`\n- PostgreSQL 14: move to `14.25`","status":"open","published_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:11+00:00","updated_at":"2026-11-12T15:43:11+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:11Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: move to `18.7`\n- PostgreSQL 17: move to `17.12`\n- PostgreSQL 16: move to `16.16`\n- PostgreSQL 15: move to `15.20`\n- PostgreSQL 14: move to `14.25`","reach":"network","title":"PostgreSQL: foreign batch inserts overflow heap, letting a foreign server run code","impact":"high","summary":"PostgreSQL's postgres_fdw extension mishandles the row count returned by a remote server during batch inserts, causing a heap buffer overflow. A malicious or compromised foreign server can use this to execute arbitrary code on the PostgreSQL instance that connects to it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","postgres_fdw","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Code runs on the PostgreSQL server via a foreign server","analyst_note":"","how_to_check":"- Check the server version with `psql -c \"SHOW server_version;\"`, then compare against the fixed versions below.\n- Check whether the postgres_fdw extension is installed with `psql -c \"\\dx postgres_fdw\"`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-postgres-fdw","fixed-version"],"who_is_affected":"Systems running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 that use the postgres_fdw extension to write to remote tables are exposed. The risk comes from the foreign server that receives the inserts, so deployments that never use postgres_fdw can skip it. unknown whether exploitation requires a specific remote rule configuration beyond normal use.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000794,"input_tokens":4604,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120149':15A,18A '-2026':14A,17A '14.25':124C '15.20':122C '16.16':121C '17.12':120C '18.7':119C 'addit':114C 'affect':126C 'allow':78C 'arbitrari':60B,84C 'base':70C 'batch':3A,42B,76C 'buffer':47B,71C 'caus':44B 'code':12A,61B,85C 'compromis':52B 'connect':67B 'count':35B 'cve':13A,16A 'databas':19B 'encount':101C 'execut':59B,83C 'expand':110C 'extens':31B 'fdw':21B,30B,98C 'foreign':2A,9A,53B,75C,80C 'heap':6A,46B,69C 'heap-bas':68C 'host':26B 'insert':4A,43B,77C,90C,112C 'instanc':65B 'legitim':100C 'let':7A 'malici':50B 'mishandl':32B 'overflow':5A,48B,72C 'postgr':20B,29B,97C 'postgresql':1A,22B,27B,64B,74C,118C 'remot':39B,108C 'report':87C 'return':36B 'row':34B,92C,115C 'rule':105C 'run':11A 'runtim':23B 'self':25B 'self-host':24B 'server':10A,40B,54B,81C,95C 'suppli':96C 'tabl':109C 'use':56B 'version':116C 'via':86C","nicknames":[],"mitigations":[],"who_affected":"Systems running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 that use the postgres_fdw extension to write to remote tables are exposed. The risk comes from the foreign server that receives the inserts, so deployments that never use postgres_fdw can skip it. unknown whether exploitation requires a specific remote rule configuration beyond normal use.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresfdw","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120149':15A,18A '-2026':14A,17A 'batch':3A 'code':12A 'cve':13A,16A 'foreign':2A,9A 'heap':6A 'insert':4A 'let':7A 'overflow':5A 'postgresql':1A 'run':11A 'server':10A","search_b":"'arbitrari':60B 'batch':42B 'buffer':47B 'caus':44B 'code':61B 'compromis':52B 'connect':67B 'count':35B 'databas':19B 'execut':59B 'extens':31B 'fdw':21B,30B 'foreign':53B 'heap':46B 'host':26B 'insert':43B 'instanc':65B 'malici':50B 'mishandl':32B 'overflow':48B 'postgr':20B,29B 'postgresql':22B,27B,64B 'remot':39B 'return':36B 'row':34B 'runtim':23B 'self':25B 'self-host':24B 'server':40B,54B 'use':56B","search_c":"'14.25':124C '15.20':122C '16.16':121C '17.12':120C '18.7':119C 'addit':114C 'affect':126C 'allow':78C 'arbitrari':84C 'base':70C 'batch':76C 'buffer':71C 'code':85C 'encount':101C 'execut':83C 'expand':110C 'fdw':98C 'foreign':75C,80C 'heap':69C 'heap-bas':68C 'insert':77C,90C,112C 'legitim':100C 'overflow':72C 'postgr':97C 'postgresql':74C,118C 'remot':108C 'report':87C 'row':92C,115C 'rule':105C 'server':81C,95C 'suppli':96C 'tabl':109C 'version':116C 'via':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120149","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120149","severity":null,"published_at":"2026-11-12T15:17:43+00:00","modified_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}