medium CVSS 5.4

CVE-2026-6472·PostgreSQL vulnerability

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity
medium
Software
PostgreSQL
Fixed in
18.4
Published

Affected versions

From: 18.0

Until: 18.4

Fixed in: 18.4

How to fix this CVE

Upgrade PostgreSQL to version 18.4 or later to patch a privilege escalation vulnerability in the CREATE TYPE command. This vulnerability allows attackers to inject malicious user-defined types that can execute arbitrary SQL functions when other users reference them through search_path resolution. Ensure all PostgreSQL instances in your environment are updated to a fixed version (18.4, 17.10, 16.14, 15.18, or 14.23 depending on your branch).

sudo dnf update postgresql postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Connect to PostgreSQL and run: SELECT version(); to verify the currently installed version number
  2. Check if non-superuser accounts have CREATE TYPE privileges by querying: SELECT grantee, privilege_type FROM information_schema.role_table_grants WHERE table_name='pg_type' AND privilege_type='CREATE';
  3. Search PostgreSQL logs for CREATE TYPE commands from unexpected users: sudo grep -i 'CREATE TYPE' /var/log/postgresql/postgresql.log | grep -v 'system'
  4. After upgrade, re-run SELECT version(); to confirm the patch version is installed and matches the fixed release

FAQ

What is CVE-2026-6472?

This vulnerability in PostgreSQL allows unprivileged users to create malicious user-defined types that can hijack query execution paths for other users, potentially leading to arbitrary SQL function execution through search_path manipulation.

Is CVE-2026-6472 being actively exploited?

No, this CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are known to be available.

What versions of PostgreSQL are affected by CVE-2026-6472?

PostgreSQL versions 18.0 through 18.3 are affected. However, earlier major versions (17, 16, 15, and 14) also have vulnerable releases; patched versions are 17.10, 16.14, 15.18, and 14.23 respectively.

How do I check if my server is vulnerable to CVE-2026-6472?

Connect to PostgreSQL and run: SELECT version(); If the version is 18.0-18.3 or an older unpatched branch (e.g., 17.9 or earlier), the system is vulnerable.

Does Defensia detect CVE-2026-6472?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6472 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-19385CVSS 8.8Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-18408CVSS 8.8Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14664CVSS 8.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6472. Free for 1 server.

Get started free