PostgreSQL patches 52 flaws, including code execution as the postgres user

PostgreSQL released an update on 13 November fixing 52 security flaws. Thirty-two of them are rated 8.8, the highest score in the release. One matters more than the rest: CVE-2026-6460, a type confusion that lets a database user run code on the server, with the rights of the operating system account that runs PostgreSQL.

The headline flaw: CVE-2026-6460

The bug lives in composite types, which are types built from named fields that each carry their own data type. A field’s type can be changed while older values of that type are still held elsewhere in the server. The server can then read an old value as if it had the new type, and that mismatch is enough to corrupt memory.

The practical consequence is code execution. The CVSS score is 8.8, and any code run this way inherits the privileges of the postgres OS user. The project’s advisory describes the attacker as someone who can create objects. Red Hat’s assessment is more specific: a database login able to create or modify objects. Neither source says whether an account with only default privileges can get past the crash and reach code execution.

The project has not reported any attacks using the flaw, and CISA’s assessment in the CVE record lists exploitation as none. The fix adds version checks so the server can detect a value that no longer matches its type.

A public writeup already demonstrates the crash

Security researcher Mehmet Ince published a technical writeup this week with a working exploit demonstrated on PostgreSQL 18.6. His method is to prepare a query that holds a value, change the type of one of that value’s fields, then run the query. The writeup includes the SQL that crashes an unpatched server and a second step that leaks memory addresses. It stops short of the final step that makes the server run a command.

Ince traces the root of the flaw to 5 May 2004, when PostgreSQL gained the ability to change a column’s type, and his execution technique relies on a change made on 14 May 2015. He also adapted the exploit for managed PostgreSQL services and shared proofs of concept privately with their security teams in August, including AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks and Ubicloud. The writeup does not state each provider’s current patch status.

The other flaws worth knowing

• CVE-2026-116322 — the only flaw in the server that needs neither a login nor user action. An unauthenticated client can trigger a restart of PostgreSQL 18 servers.
• pg_restore — a crafted archive can make it run code as the user running it.
• pg_dump and psql — a compromised source server can make psql run code through the restore script embedded in pg_dump’s tar output.

What administrators should do

• Update the server to 18.7, 17.12, 16.16, 15.20 or 14.25, matching your major version.
• Rebuild every C-language extension at the same time as the server. Extensions built against older releases still load, but may not be protected from the fixed vulnerabilities. Some will also need source changes.
• Restart immediately after updating if PostgreSQL runs outside its package’s own service unit, for example under Patroni.
• Update client tools — pg_dump, pg_restore, reindexdb and vacuumdb — on every machine that runs them.
• Do not disable the new checks. The release adds a composite_type_mismatch setting; the project says turning it off carries security risk.
• No workaround exists for servers that cannot be updated yet, according to the advisory and release notes.
• Follow the reindexing steps in the release announcement. If you use incremental backups, take a new full backup and base later incrementals on it.

One deadline to note: PostgreSQL 14 reached end of life, and 14.25 is its final release. Older major versions are also affected and received no update, so staying on them means carrying these flaws permanently.

Why the extension step is the one people skip

Server packages and extension packages move together in the project’s RPM repositories: extension packages now require the new minor release, and extensions rebuilt for the new release can fail to load on older servers. That coupling is deliberate. Patching the server alone leaves extension code compiled against the old type handling still running inside the new server, which is exactly the state this class of bug exploits.

Sources: the PostgreSQL release announcement and release notes, The Hacker News report of 13 November 2026, and Red Hat’s CVE assessment.