Servers and applications

CVE-2026-6467

PostgreSQL extension script schema mishandling executes arbitrary SQL

Severity: High 7.2
Published: 12 Nov 2026
Last changed: 13 Nov 2026
Added to UpHeron: 13 Nov 2026
Fixed in: 14.25, 15.20, 16.16, 17.12, 18.7
Weakness: CWE-427
Attack: Over the network · Needs an administrator account · No user action needed
Attacker can: Read data · Change data · Take it down
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Sources: CVE Program

Description

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

From the CVE Program.

Affected software

Software	Affected versions
PostgreSQLServers and applications · `cna:n/a\|postgresql`	Every version before 14.25 From 15 before 15.20 From 16 before 16.16 From 17 before 17.12 From 18 before 18.7

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6467