{"id":"CVE-2026-6467","kind":"vulnerability","aliases":["CVE-2026-6467"],"related":[],"title":"PostgreSQL: CREATE EXTENSION search path lets a database user run code as superuser","description":"Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\".  ALTER EXTENSION was also affected.  A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's CREATE EXTENSION and ALTER EXTENSION commands can be tricked into running an attacker's SQL, because a trusted extension script resolves the wrong object through the search path. An attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","only-superuser-creates-objects"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether any user besides the superuser holds CREATE privilege on a database: `\\l` and `\\dn+` in psql.","fix":"- PostgreSQL 18: upgrade to `18.7`\n- PostgreSQL 17: upgrade to `17.12`\n- PostgreSQL 16: upgrade to `16.16`\n- PostgreSQL 15: upgrade to `15.20`\n- PostgreSQL 14: upgrade to `14.25`","status":"open","published_at":"2026-11-12T15:17:51+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","triaged_at":"2026-11-12T15:43:49+00:00","updated_at":"2026-11-12T15:43:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-12T15:43:49Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL 18: upgrade to `18.7`\n- PostgreSQL 17: upgrade to `17.12`\n- PostgreSQL 16: upgrade to `16.16`\n- PostgreSQL 15: upgrade to `15.20`\n- PostgreSQL 14: upgrade to `14.25`","reach":"network","title":"PostgreSQL: CREATE EXTENSION search path lets a database user run code as superuser","impact":"high","summary":"PostgreSQL's CREATE EXTENSION and ALTER EXTENSION commands can be tricked into running an attacker's SQL, because a trusted extension script resolves the wrong object through the search path. An attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary SQL as the bootstrap superuser on the database server.","analyst_note":"","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Check whether any user besides the superuser holds CREATE privilege on a database: `\\l` and `\\dn+` in psql.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","only-superuser-creates-objects"],"who_is_affected":"Any PostgreSQL server before the fixed versions is exposed, but only to users who already hold CREATE privilege on a database, such as a schema owner or a role given database-level CREATE. Deployments where only the superuser can create objects are much less exposed. Teams should inventory roles with CREATE privilege and move to a fixed release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000806,"input_tokens":4656,"output_tokens":681,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-6467':16A,19A '14.25':137C '15.20':135C '16.16':134C '17.12':133C '18.7':132C 'affect':110C,139C 'allow':80C 'also':109C 'alter':31B,98C,106C 'arbitrari':66B,91C,122C 'attack':40B,57B,82C,126C 'bootstrap':70B,95C 'choic':128C 'code':11A,67B,92C 'command':33B 'creat':2A,28B,62B,78C,87C,102C 'cve':14A,17A 'databas':8A,20B,60B,85C 'database-level':59B,84C 'element':75C 'execut':65B,90C,121C 'extens':3A,29B,32B,46B,79C,103C,107C,114C 'host':25B 'let':6A 'level':61B,86C 'locat':116C 'object':51B,119C 'path':5A,55B,74C 'postgresql':1A,21B,26B,77C,131C 'privileg':63B,88C 'renam':100C 'resolv':48B 'run':10A,38B 'runtim':22B 'schema':99C,104C 'script':47B,115C 'search':4A,54B,73C 'self':24B 'self-host':23B 'sql':42B,123C 'superus':13A,71B,96C 'trick':36B 'trust':45B,113C 'trusted-extens':112C 'uncontrol':72C 'user':9A,105C 'version':129C 'via':97C 'wrong':50B,118C","nicknames":[],"mitigations":[],"who_affected":"Any PostgreSQL server before the fixed versions is exposed, but only to users who already hold CREATE privilege on a database, such as a schema owner or a role given database-level CREATE. Deployments where only the superuser can create objects are much less exposed. Teams should inventory roles with CREATE privilege and move to a fixed release.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-6467':16A,19A 'code':11A 'creat':2A 'cve':14A,17A 'databas':8A 'extens':3A 'let':6A 'path':5A 'postgresql':1A 'run':10A 'search':4A 'superus':13A 'user':9A","search_b":"'alter':31B 'arbitrari':66B 'attack':40B,57B 'bootstrap':70B 'code':67B 'command':33B 'creat':28B,62B 'databas':20B,60B 'database-level':59B 'execut':65B 'extens':29B,32B,46B 'host':25B 'level':61B 'object':51B 'path':55B 'postgresql':21B,26B 'privileg':63B 'resolv':48B 'run':38B 'runtim':22B 'script':47B 'search':54B 'self':24B 'self-host':23B 'sql':42B 'superus':71B 'trick':36B 'trust':45B 'wrong':50B","search_c":"'14.25':137C '15.20':135C '16.16':134C '17.12':133C '18.7':132C 'affect':110C,139C 'allow':80C 'also':109C 'alter':98C,106C 'arbitrari':91C,122C 'attack':82C,126C 'bootstrap':95C 'choic':128C 'code':92C 'creat':78C,87C,102C 'databas':85C 'database-level':84C 'element':75C 'execut':90C,121C 'extens':79C,103C,107C,114C 'level':86C 'locat':116C 'object':119C 'path':74C 'postgresql':77C,131C 'privileg':88C 'renam':100C 'schema':99C,104C 'script':115C 'search':73C 'sql':123C 'superus':96C 'trust':113C 'trusted-extens':112C 'uncontrol':72C 'user':105C 'version':129C 'via':97C 'wrong':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-6467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6467","severity":null,"published_at":"2026-11-12T15:17:51+00:00","modified_at":"2026-11-12T15:17:51+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","fetched_at":"2026-11-12T15:41:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}