CVE-2026-6470·PostgreSQL vulnerability
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
- Severity
- medium
- Software
- PostgreSQL
- Fixed in
- 18.5
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.33% — higher than 25% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Affected versions
From: 18.0
Until: 18.5
Fixed in: 18.5
How to fix this CVE
Upgrade PostgreSQL to version 18.6 or later to address a privilege escalation vulnerability in DDL command authorization. Authenticated users with object creation privileges can exploit missing authorization checks on range subtype assignments and type references to trigger denial of service conditions. Apply this update promptly, especially in environments where database access is granted to multiple application users or third-party services.
sudo dnf update postgresql-server postgresql-contribDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check PostgreSQL version with 'sudo -u postgres psql -c "SELECT version();"' and confirm it is below 18.6, 17.11, 16.15, 15.19, or 14.24
- Step 2: Query the pg_type system catalog for custom range types created by non-superuser accounts using 'sudo -u postgres psql -c "SELECT typname, typowner FROM pg_type WHERE typrange != 0 AND typowner != 10;"'
- Step 3: Search PostgreSQL logs for failed ALTER TYPE or DROP TYPE commands with 'grep -i "ALTER TYPE\|DROP TYPE" /var/log/postgresql/postgresql*.log | grep -i "denied\|permission\|depend'
- Step 4: After patching, re-run the version check to confirm PostgreSQL is at 18.6 or later with 'sudo -u postgres psql -c "SELECT version();"'
FAQ
What is CVE-2026-6470?
This CVE describes a flaw in PostgreSQL's authorization logic for data definition language (DDL) commands where certain operations on custom types—specifically assigning range subtypes and referencing types in SQL expressions—do not properly validate user privileges. An authenticated attacker can exploit this to create dependencies that block legitimate ALTER and DROP operations.
Is CVE-2026-6470 being actively exploited?
No, CVE-2026-6470 is not listed in the CISA Known Exploited Vulnerabilities catalog and no public exploits are currently available. However, the vulnerability requires only authenticated database access, making it a concern in shared or multi-tenant database environments.
What versions of PostgreSQL are affected by CVE-2026-6470?
PostgreSQL versions 18.0 through 18.5, 17.0 through 17.10, 16.0 through 16.14, 15.0 through 15.18, and 14.0 through 14.23 are affected. The vulnerability is patched in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24.
How do I check if my server is vulnerable to CVE-2026-6470?
Run 'sudo -u postgres psql -c "SELECT version();"' to retrieve the PostgreSQL version. If the output shows a version number lower than 18.6 (or 17.11, 16.15, 15.19, 14.24 for older release branches), your server is vulnerable and requires an upgrade.
Does Defensia detect CVE-2026-6470?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6470 will appear in your dashboard with remediation steps.
Related PostgreSQL CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6470. Free for 1 server.
Get started free