---
id: "CVE-2026-18447"
page: "https://infrastack.ai/live/CVE-2026-18447"
kind: "vulnerability"
aliases: ["CVE-2026-18447"]
title: "PostgreSQL: type confusion lets a function creator run OS code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-untrusted-object-creators", "patched-version"]
published_at: "2026-11-12T15:17:51+00:00"
first_seen_at: "2026-11-12T15:41:57+00:00"
updated_at: "2026-11-12T15:43:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18447", "first_seen_at": "2026-11-12T15:41:57+00:00"}]
exploit_sources: []
---

# PostgreSQL: type confusion lets a function creator run OS code

Link for people: https://infrastack.ai/live/CVE-2026-18447 (this .md is for agents)

A flaw in PostgreSQL SQL-language functions lets a user who can create database objects confuse types through an output parameter of type "any". The attacker can execute arbitrary code as the operating system user running the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `psql -c "SHOW server_version;"` and compare against the fixed versions below.
- Confirm which roles can `CREATE` functions in your databases.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18447

## From the sources

Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any".  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_