PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

The vulnerability, tracked as CVE-2026-6460, has a CVSS score of 8.8 and involves a type confusion flaw in composite types. When a field's type is changed while older values of that type remain in the server, it could lead to reading old values as if they had the new type. The fix adds version checks to detect values that no longer match their type.

Security researcher Mehmet Ince demonstrated a working exploit for the flaw on PostgreSQL 18.6, showing how a query can be prepared to hold a value, then have a field's type changed before running the query. His method crashes an unpatched server and leaks memory addresses, though he did not include the final step that would make the server execute commands.

Exploit Details

Ince traced the flaw's root to May 5, 2004, when PostgreSQL gained the ability to change a column's type. His exploit technique relies on a later change made on May 14, 2015. He adapted the exploit for managed PostgreSQL services and shared proofs of concept with AWS, Microsoft, Google, Supabase, Databricks, and Ubicloud security teams in August.

Patch Requirements

Administrators must update to PostgreSQL versions 18.7, 17.12, 16.16, 15.20, or 14.25, matching their major version. Full protection requires rebuilding or updating every C-language extension at the same time as the server, as extensions built against older releases may not be protected. Extensions rebuilt for new releases won't work on older servers.

Client tools like pg_dump, pg_restore, reindexdb, and vacuumdb also need updating on every machine that runs them. The project warns against using the new composite_type_mismatch setting to disable checks, as doing so carries security risks. PostgreSQL 14 is now end-of-life, with 14.25 being its last release.

Additional Vulnerabilities

The project rated 32 of the 52 flaws at 8.8, the highest score in the release. Only one flaw, CVE-2026-116322, allows an unauthenticated client to trigger a restart of PostgreSQL 18 servers. Other fixes address issues in client tools, where crafted archives or compromised source servers could make pg_restore and psql run code respectively.

After updating, administrators should follow reindexing steps in the release announcement and take a new full backup if using incremental backups. The project credits more than a dozen reporters for the vulnerabilities, including Mehmet Ince, who was credited on five other flaws in the same release.