---
id: "GHSA-fv9p-9rr9-fm35"
kind: "vulnerability"
aliases: ["GHSA-fv9p-9rr9-fm35"]
title: "CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["aws", "babelfish", "lab-disclosure", "postgresql", "runtime", "sql-server-compatibility"]
not_affected_if: ["not-babelfish", "patched-version"]
published_at: null
first_seen_at: "2026-11-03T18:52:11+00:00"
updated_at: "2026-11-03T18:53:50+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/", "first_seen_at": "2026-11-03T18:52:11+00:00"}]
---

# CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation

Babelfish for PostgreSQL, the extension that runs SQL Server workloads on PostgreSQL, has an improper access control flaw. A remote authenticated user can elevate their privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Babelfish extension version in the PostgreSQL database.
- Affected versions are `1.2-1.5`, `2.1-2.15`, `3.1-3.12`, `4.0-4.8` and `5.1-5.4`.

## Fix

- Upgrade to Babelfish for PostgreSQL `4.10`, `5.6`, or `6.1` or later, depending on your release line.

## Timeline

- 2026-11-03T18:52:11+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/ — AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation

## Documents

- [mentions] AWS: CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/

## From the sources

CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation

### CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation

Bulletin ID: 2026-165-AWS Scope: AWS Content Type: Important (requires attention)/Informational Publication Date: 11/03/2026 10:00 AM PST

Description:

Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/. 

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.

Impacted versions:

- 1.2-1.5
- 2.1-2.15
- 3.1-3.12
- 4.0-4.8
- 5.1-5.4

Resolution:

This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.

References:

- CVE-2026-119922
- GHSA-fv9p-9rr9-fm35

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_