CVEvulnerability
CVE-2026-6472
5.4 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-05-14
- Last modified
- 2026-06-17
- Assigner
- f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
- CVSS 3.1 (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-862
Description
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected configurations
• postgresql postgresql (< 14.23)
• postgresql postgresql (>= 15.0 < 15.18)
• postgresql postgresql (>= 16.0 < 16.14)
• postgresql postgresql (>= 17.0 < 17.10)
• postgresql postgresql (>= 18.0 < 18.4)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://www.postgresql.org/support/security/CVE-2026-6472/ Patch, Vendor Advisory