Live › vulnerability › GHSA-fv9p-9rr9-fm35
Babelfish for PostgreSQL, the extension that runs SQL Server workloads on PostgreSQL, has an improper access control flaw. A remote authenticated user can elevate their privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:52 UTC. All times on this page are UTC.
Teams running Babelfish for PostgreSQL on the affected version ranges, including self-managed deployments and any forks or derivatives. The sources say the attacker must be a remote authenticated user, so exposure depends on who holds database accounts. Teams not running Babelfish can skip it.
No product ranges from the sources yet.
1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8 and 5.1-5.4.4.10, , or or later, depending on your release line.5.66.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation
Bulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST
Description:
Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/.
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Impacted versions:
Resolution:
This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
There is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-fv9p-9rr9-fm35")