{"id":"CVE-2026-120151","kind":"vulnerability","aliases":["CVE-2026-120151"],"related":[],"title":"PostgreSQL: plpgsql record-field type confusion lets object creator run OS code","description":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A type confusion bug in PostgreSQL's plpgsql record-field assignment lets a user who can create database objects run arbitrary code as the operating system user running the database. The flaw is triggered through a reentrant domain CHECK that changes a RECORD variable's row type during a cast.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["fixed-version","only-trusted-object-creators"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Check whether untrusted users can create domains or functions in your databases.","fix":"- Upgrade to `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` depending on the major version in use.","status":"open","published_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:07+00:00","updated_at":"2026-11-12T15:43:07+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` depending on the major version in use.","reach":"network","title":"PostgreSQL: plpgsql record-field type confusion lets object creator run OS code","impact":"high","summary":"A type confusion bug in PostgreSQL's plpgsql record-field assignment lets a user who can create database objects run arbitrary code as the operating system user running the database. The flaw is triggered through a reentrant domain CHECK that changes a RECORD variable's row type during a cast.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the database operating system user.","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions listed below.\n- Check whether untrusted users can create domains or functions in your databases.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","only-trusted-object-creators"],"who_is_affected":"PostgreSQL servers running versions before 18.7, 17.12, 16.18, 15.20, or 14.25 are affected. The attacker needs the ability to create objects (such as domains and functions) in the database, so servers where only trusted administrators can create objects face much less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4580,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120151':16A,19A '-2026':15A,18A '14.25':129C '15.20':127C '16.16':126C '17.12':125C '18.7':124C 'affect':131C 'allow':86C 'arbitrari':47B,92C 'assign':37B,85C 'bug':29B 'cast':76B,120C 'chang':67B,108C 'check':65B,106C 'code':13A,48B,93C 'confus':7A,28B,78C 'creat':43B 'creator':10A,89C 'cve':14A,17A 'databas':20B,44B,56B,101C 'domain':64B,105C 'execut':91C 'field':5A,36B,84C 'flaw':58B 'host':25B 'let':8A,38B 'object':9A,45B,88C 'oper':51B,96C 'os':12A 'plpgsql':2A,33B,81C 'postgresql':1A,21B,31B,80C,123C 'record':4A,35B,69B,83C,110C 'record-field':3A,34B,82C 'reentrant':63B,104C 'row':72B,113C 'run':11A,46B,54B,99C 'runtim':22B 'self':24B 'self-host':23B 'system':52B,97C 'trigger':60B 'type':6A,27B,73B,77C,114C 'user':40B,53B,98C 'valu':117C 'variabl':70B,111C 'version':121C 'via':102C","nicknames":[],"mitigations":[],"who_affected":"PostgreSQL servers running versions before 18.7, 17.12, 16.18, 15.20, or 14.25 are affected. The attacker needs the ability to create objects (such as domains and functions) in the database, so servers where only trusted administrators can create objects face much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120151':16A,19A '-2026':15A,18A 'code':13A 'confus':7A 'creator':10A 'cve':14A,17A 'field':5A 'let':8A 'object':9A 'os':12A 'plpgsql':2A 'postgresql':1A 'record':4A 'record-field':3A 'run':11A 'type':6A","search_b":"'arbitrari':47B 'assign':37B 'bug':29B 'cast':76B 'chang':67B 'check':65B 'code':48B 'confus':28B 'creat':43B 'databas':20B,44B,56B 'domain':64B 'field':36B 'flaw':58B 'host':25B 'let':38B 'object':45B 'oper':51B 'plpgsql':33B 'postgresql':21B,31B 'record':35B,69B 'record-field':34B 'reentrant':63B 'row':72B 'run':46B,54B 'runtim':22B 'self':24B 'self-host':23B 'system':52B 'trigger':60B 'type':27B,73B 'user':40B,53B 'variabl':70B","search_c":"'14.25':129C '15.20':127C '16.16':126C '17.12':125C '18.7':124C 'affect':131C 'allow':86C 'arbitrari':92C 'assign':85C 'cast':120C 'chang':108C 'check':106C 'code':93C 'confus':78C 'creator':89C 'databas':101C 'domain':105C 'execut':91C 'field':84C 'object':88C 'oper':96C 'plpgsql':81C 'postgresql':80C,123C 'record':83C,110C 'record-field':82C 'reentrant':104C 'row':113C 'run':99C 'system':97C 'type':77C,114C 'user':98C 'valu':117C 'variabl':111C 'version':121C 'via':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120151","severity":null,"published_at":"2026-11-12T15:17:43+00:00","modified_at":"2026-11-12T15:17:43+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}