{"id":"GHSA-fv9p-9rr9-fm35","kind":"vulnerability","aliases":["GHSA-fv9p-9rr9-fm35"],"related":[],"title":"CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation","description":"CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\n### CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\nBulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\n\nImpacted versions:\n\n- 1.2-1.5\n- 2.1-2.15\n- 3.1-3.12\n- 4.0-4.8\n- 5.1-5.4\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.\n\nReferences:\n\n- CVE-2026-119922\n- GHSA-fv9p-9rr9-fm35\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Babelfish for PostgreSQL, the extension that runs SQL Server workloads on PostgreSQL, has an improper access control flaw. A remote authenticated user can elevate their privileges.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","babelfish","lab-disclosure","postgresql","runtime","sql-server-compatibility"],"not_affected_if":["not-babelfish","patched-version"],"how_to_check":"- Check the installed Babelfish extension version in the PostgreSQL database.\n- Affected versions are `1.2-1.5`, `2.1-2.15`, `3.1-3.12`, `4.0-4.8` and `5.1-5.4`.","fix":"- Upgrade to Babelfish for PostgreSQL `4.10`, `5.6`, or `6.1` or later, depending on your release line.","status":"open","published_at":null,"first_seen_at":"2026-11-03T18:52:11+00:00","triaged_at":"2026-11-03T18:53:50+00:00","updated_at":"2026-11-03T18:53:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T18:53:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to Babelfish for PostgreSQL `4.10`, `5.6`, or `6.1` or later, depending on your release line.","reach":"network","title":"Babelfish for PostgreSQL: improper access control lets authenticated users escalate privileges","impact":"medium","summary":"Babelfish for PostgreSQL, the extension that runs SQL Server workloads on PostgreSQL, has an improper access control flaw. A remote authenticated user can elevate their privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["babelfish","postgresql","aws","sql-server-compatibility"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user gains higher database privileges than granted","analyst_note":"","how_to_check":"- Check the installed Babelfish extension version in the PostgreSQL database.\n- Affected versions are `1.2-1.5`, `2.1-2.15`, `3.1-3.12`, `4.0-4.8` and `5.1-5.4`.","plain_action":"","needs_analyst":false,"not_affected_if":["not-babelfish","patched-version"],"who_is_affected":"Teams running Babelfish for PostgreSQL on the affected version ranges, including self-managed deployments and any forks or derivatives. The sources say the attacker must be a remote authenticated user, so exposure depends on who holds database accounts. Teams not running Babelfish can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000749,"input_tokens":4712,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1.5':143C,183C '-119922':3A,58C,66C,251C '-165':75C '-2.15':145C,185C '-2026':2A,57C,65C,250C '-3.12':147C,187C '-4.8':149C,189C '-5.4':151C,191C '/babelfish-for-postgresql/babelfish_extensions/.':131C '/informational':84C '00':89C '1.2':142C,182C '10':88C '11/03/2026':87C '2.1':144C,184C '2026':74C '3.1':146C,186C '4.0':148C,188C '4.10':175C,204C '5.1':150C,190C '5.6':176C,205C '6.1':177C,207C '9rr9':12A,17A,255C 'access':45B,133C 'address':197C 'allow':153C 'applic':107C 'attent':83C 'authent':50B,155C 'aw':19B,76C,78C,127C 'aws-security@amazon.com':259C 'babelfish':4A,20B,30B,59C,67C,93C,108C,137C,170C,199C 'bulletin':72C 'code':221C 'compat':29B 'concern':265C 'content':79C 'control':46B,134C 'cve':1A,56C,64C,249C 'date':86C 'deriv':220C 'descript':92C 'develop':110C 'disclosur':23B 'elev':53B,158C 'email':258C 'enabl':97C 'ensur':216C 'escal':8A,63C,71C 'extens':34B,96C,119C,140C,173C,202C 'fix':228C 'flaw':47B 'fm35':13A,18A,256C 'fork':218C 'fv9p':11A,16A,254C 'ghsa':10A,15A,253C 'ghsa-fv9p-9rr9-fm35':9A,14A,252C 'github.com':130C 'github.com/babelfish-for-postgresql/babelfish_extensions/.':129C 'id':73C 'impact':180C 'import':81C 'improp':44B,132C 'incorpor':225C 'issu':164C,194C,236C,247C 'lab':22B 'lab-disclosur':21B 'later':179C 'latest':213C 'maintain':125C 'may':152C 'model':120C 'modifi':105C 'new':227C 'opensourc':113C 'own':123C 'patch':223C,240C 'pleas':257C 'postgresql':6A,24B,32B,41B,61C,69C,95C,117C,139C,172C,201C 'privileg':7A,55B,62C,70C,160C 'project':114C 'pst':91C 'public':85C 'question':263C 'recommend':166C,209C 'refer':248C 'remedi':162C,245C 'remot':49B,154C 'requir':82C,243C 'resolut':192C 'run':36B,100C 'runtim':25B 'scope':77C 'secur':262C 'server':28B,38B,102C 'sql':27B,37B,101C 'sql-server-compat':26B 'type':80C 'upgrad':168C,210C,237C 'use':115C 'user':51B,98C,156C 'version':141C,174C,181C,203C,214C,241C 'without':104C 'workaround':229C,233C 'workload':39B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running Babelfish for PostgreSQL on the affected version ranges, including self-managed deployments and any forks or derivatives. The sources say the attacker must be a remote authenticated user, so exposure depends on who holds database accounts. Teams not running Babelfish can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aws","babelfish","labdisclosure","postgresql","runtime","sqlservercompatibility","unknown"],"campaign_type":null,"first_public_at":"2026-11-03T18:26:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/#GHSA-fv9p-9rr9-fm35","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-03T18:52:11+00:00","fetched_at":"2026-11-03T18:52:11+00:00","note":"AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation"}],"documents":[{"id":59788,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/","title":"AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation","kind":"vendor","source":"vendor","publisher":"research","text":"CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\n### CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation\n\nBulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST\n\nDescription:\n\nBabelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/. \n\nImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\n\nImpacted versions:\n\n- 1.2-1.5\n- 2.1-2.15\n- 3.1-3.12\n- 4.0-4.8\n- 5.1-5.4\n\nResolution:\n\nThis issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nThere is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.\n\nReferences:\n\n- CVE-2026-119922\n- GHSA-fv9p-9rr9-fm35\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-11-03T18:26:54+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}