---
id: "CVE-2026-6460"
page: "https://infrastack.ai/live/CVE-2026-6460"
kind: "vulnerability"
aliases: ["CVE-2026-6460"]
title: "PostgreSQL: type confusion lets a DDL user run OS code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["patched-version"]
published_at: "2026-11-12T15:17:51+00:00"
first_seen_at: "2026-11-12T15:41:57+00:00"
updated_at: "2026-11-12T15:43:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6460", "first_seen_at": "2026-11-12T15:41:57+00:00"}]
exploit_sources: []
---

# PostgreSQL: type confusion lets a DDL user run OS code

Link for people: https://infrastack.ai/live/CVE-2026-6460 (this .md is for agents)

PostgreSQL has a type confusion flaw in how it tracks typed values, so a user who can create database objects can misuse ALTER ... SET DATA TYPE and related DDL. The sources say this lets that user execute arbitrary code as the operating system account running the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running server version with `SELECT version();` and compare it to the fixed releases.
- Confirm which roles can create objects or run ALTER TABLE in your databases.

## Fix

- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, `14.25` or later; earlier versions are affected.

## Timeline

- 2026-11-12T15:41:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-6460

## Documents

- [discussion] r/netsec: prepared statements prevents SQLi. But it also helped me to exploit a 22 years old PostgreSQL 0-day RCE (CVE-2026-6460) https://www.reddit.com/r/netsec/comments/1xuh3jj/prepared_statements_prevents_sqli_but_it_also/

## From the sources

Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.  Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN".  The system had inadequate tracking of typed values, and values were not self-identifying.  Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system.  PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_