CVE-2026-14671·PostgreSQL vulnerability
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Severity
- high
- Software
- PostgreSQL
- Fixed in
- 18.5
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.42% — higher than 34% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2026-14671 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.42%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
Affected versions
From: 18.0
Until: 18.5
Fixed in: 18.5
How to fix this CVE
Upgrade PostgreSQL to version 18.6 or later to patch a type confusion vulnerability in the refint module that could allow authenticated users to execute arbitrary code with database server privileges. Organizations running PostgreSQL 18.0–18.5 should prioritize this update to eliminate the risk of local privilege escalation.
sudo dnf update postgresql-server postgresql-contribDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check installed PostgreSQL version by running: psql --version or sudo -u postgres psql -c 'SELECT version();'
- Step 2: Verify if the refint module is loaded by querying: SELECT * FROM pg_extension WHERE extname = 'refint';
- Step 3: Review PostgreSQL server logs for suspicious code execution or unexpected function calls in the refint module context: grep -i 'refint\|type.*confusion' /var/log/postgresql/*.log
- Step 4: Confirm the patch is applied by verifying PostgreSQL version is 18.6 or later: sudo -u postgres psql -c 'SELECT version();' | grep -E '(18\.[6-9]|1[9-9]\.)'
FAQ
What is CVE-2026-14671?
CVE-2026-14671 is a type confusion vulnerability in PostgreSQL's refint module that permits authenticated users to bypass type safety mechanisms and execute arbitrary code at the operating system level with the privileges of the database service account.
Is CVE-2026-14671 being actively exploited?
No, CVE-2026-14671 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploits are available.
What versions of PostgreSQL are affected by CVE-2026-14671?
PostgreSQL versions 18.0 through 18.5 are vulnerable. Versions 18.6, 17.11, 16.15, 15.19, and 14.24 and later include the fix.
How do I check if my server is vulnerable to CVE-2026-14671?
Run: sudo -u postgres psql -c 'SELECT version();' and verify the version number is below 18.6. If refint module is installed, check: SELECT * FROM pg_extension WHERE extname = 'refint';
Does Defensia detect CVE-2026-14671?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-14671 will appear in your dashboard with remediation steps.
Related PostgreSQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-14671. Free for 1 server.
Get started free