{"id":"CVE-2026-120153","kind":"vulnerability","aliases":["CVE-2026-120153"],"related":[],"title":"PostgreSQL: SQL injection in extension scripts lets a CREATE-privilege user run code as superuser","description":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings.  This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL extension-script substitutions do not escape schema or owner names, so a crafted name containing newlines or special substrings injects SQL. An attacker with database-level CREATE privilege can run arbitrary code as the bootstrap superuser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["bundled-extensions-only","no-create-privilege-users","patched-version"],"how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed versions below.\n- Look for non-bundled extensions installed on the server that use script substitutions of schema or owner names.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:44+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","triaged_at":"2026-11-12T15:43:49+00:00","updated_at":"2026-11-12T15:43:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:49Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"network","title":"PostgreSQL: SQL injection in extension scripts lets a CREATE-privilege user run code as superuser","impact":"high","summary":"PostgreSQL extension-script substitutions do not escape schema or owner names, so a crafted name containing newlines or special substrings injects SQL. An attacker with database-level CREATE privilege can run arbitrary code as the bootstrap superuser.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the bootstrap superuser","analyst_note":"","how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed versions below.\n- Look for non-bundled extensions installed on the server that use script substitutions of schema or owner names.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","bundled-extensions-only","no-create-privilege-users"],"who_is_affected":"Any PostgreSQL server before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. Exposure needs a non-bundled extension with a vulnerable script pattern and a user who holds database-level CREATE privilege. Servers where only trusted administrators can create objects, or that run only bundled extensions, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4614,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120153':19A,22A '-2023':110C '-2026':18A,21A '-39417':111C '14.25':133C '15.20':131C '16.16':130C '17.12':129C '18.7':128C 'affect':135C 'allow':76C 'arbitrari':62B,87C 'attack':53B,78C 'bootstrap':66B,91C 'bundl':118C 'code':14A,63B,88C 'contain':45B,99C 'craft':43B 'creat':10A,58B,83C 'create-privileg':9A 'cve':17A,20A,109C 'databas':23B,56B,81C 'database-level':55B,80C 'escap':36B 'execut':86C 'extens':5A,31B,73C,119C 'extension-script':30B,72C 'host':28B 'inject':3A,50B,69C 'let':7A 'level':57B,82C 'name':40B,44B,98C 'newlin':46B,100C 'non':117C 'non-bundl':116C 'owner':39B,97C 'pattern':124C 'postgresql':1A,24B,29B,71C,127C 'privileg':11A,59B,84C 'requir':114C 'run':13A,61B 'runtim':25B 'schema':37B,95C 'script':6A,32B,74C,123C 'self':27B 'self-host':26B 'similar':107C 'special':48B,103C 'sql':2A,51B,68C 'substitut':33B,75C 'substr':49B,104C 'superus':16A,67B,92C 'user':12A 'version':125C 'via':93C 'vulner':122C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. Exposure needs a non-bundled extension with a vulnerable script pattern and a user who holds database-level CREATE privilege. Servers where only trusted administrators can create objects, or that run only bundled extensions, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120153':19A,22A '-2026':18A,21A 'code':14A 'creat':10A 'create-privileg':9A 'cve':17A,20A 'extens':5A 'inject':3A 'let':7A 'postgresql':1A 'privileg':11A 'run':13A 'script':6A 'sql':2A 'superus':16A 'user':12A","search_b":"'arbitrari':62B 'attack':53B 'bootstrap':66B 'code':63B 'contain':45B 'craft':43B 'creat':58B 'databas':23B,56B 'database-level':55B 'escap':36B 'extens':31B 'extension-script':30B 'host':28B 'inject':50B 'level':57B 'name':40B,44B 'newlin':46B 'owner':39B 'postgresql':24B,29B 'privileg':59B 'run':61B 'runtim':25B 'schema':37B 'script':32B 'self':27B 'self-host':26B 'special':48B 'sql':51B 'substitut':33B 'substr':49B 'superus':67B","search_c":"'-2023':110C '-39417':111C '14.25':133C '15.20':131C '16.16':130C '17.12':129C '18.7':128C 'affect':135C 'allow':76C 'arbitrari':87C 'attack':78C 'bootstrap':91C 'bundl':118C 'code':88C 'contain':99C 'creat':83C 'cve':109C 'databas':81C 'database-level':80C 'execut':86C 'extens':73C,119C 'extension-script':72C 'inject':69C 'level':82C 'name':98C 'newlin':100C 'non':117C 'non-bundl':116C 'owner':97C 'pattern':124C 'postgresql':71C,127C 'privileg':84C 'requir':114C 'schema':95C 'script':74C,123C 'similar':107C 'special':103C 'sql':68C 'substitut':75C 'substr':104C 'superus':92C 'version':125C 'via':93C 'vulner':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120153","severity":null,"published_at":"2026-11-12T15:17:44+00:00","modified_at":"2026-11-12T15:17:44+00:00","first_seen_at":"2026-11-12T15:41:56+00:00","fetched_at":"2026-11-12T15:41:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}