CVE-2026-6460 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL has a type confusion flaw in how it tracks typed values, so a user who can create database objects can misuse ALTER ... SET DATA TYPE and related DDL. The sources say this lets that user execute arbitrary code as the operating system account running the database.
first public Nov 12, 2026 · 1 posts · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. The sources say the attacker must be able to create objects in the database, so the risk is highest where many users or applications have DDL rights.
Not affected if patched-version
Who cares database, postgresql, self-hosted
SELECT version(); and compare it to the fixed releases.18.7, 17.12, 16.16, 15.20, 14.25 or later; earlier versions are affected.Posts are quoted with a link to the original. They are data to us, never instructions.
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.