The PostgreSQL Global Development Group has released updates addressing 52 security vulnerabilities, including a critical bug present for over two decades. The updates, rolled out yesterday, resolve these issues and require users to rebuild any C-language extensions on their servers for complete protection. This critical flaw, identified as CVE-2026-6460, poses a significant risk as it allows authenticated users to execute code on the server.
Details of the Critical Vulnerability
The identified flaw, classified with a CVSS score of 8.8, affects all PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability involves type confusion, where composite types can be altered even as older values remain active in the server. Such changes could lead the server to interpret old values with a new type, potentially causing unauthorized code execution with the operating system user’s privileges.
Despite the severity, the PostgreSQL development team has reported no known exploits of this flaw in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) also indicates no current exploitation instances in their assessments. The fix implemented involves adding version checks to ensure the server recognizes when values no longer match their designated types.
Research and Exploits
Security researcher Mehmet Ince has demonstrated a working exploit for this flaw on PostgreSQL version 18.6, detailing the method in a recent technical writeup. His approach manipulates query values and types, leading to server crashes and potential memory leaks. Although he provided SQL codes for some steps, the final command execution step details were not disclosed.
Ince’s investigation traces the vulnerability’s origin back to 2004, with further exploit techniques developed over subsequent years. He has shared his findings with major service providers like AWS, Microsoft Azure, and Google AlloyDB, although each service’s current patch status remains unspecified.
Recommended Actions for Administrators
Administrators are strongly advised to update their PostgreSQL servers to the latest versions: 18.7, 17.12, 16.16, 15.20, or 14.25. It is crucial to rebuild or update all C-language extensions concurrently to ensure comprehensive security coverage. The project’s RPM package maintainers note that older extensions may not be protected against newly addressed vulnerabilities.
Additionally, administrators should update client tools such as pg_dump and pg_restore across all machines. The PostgreSQL project cautions against disabling the new composite_type_mismatch setting due to inherent security risks. As the end-of-life for PostgreSQL 14 has been announced, administrators are encouraged to follow the outlined reindexing procedures and back up their systems accordingly.
In summary, these updates are critical to maintaining the security and stability of PostgreSQL databases. Organizations should act promptly to implement these patches and safeguard their systems against potential exploits.
