PostgreSQL patches 22-year-old bug allowing authenticated users to run code on the server

The PostgreSQL Global Development Group has released updates to patch 52 security flaws, including a critical type confusion vulnerability tracked as CVE-2026-6460 with a CVSS score of 8.8. This flaw, rooted in a 2004 feature allowing column type changes, allows an authenticated database user who can create objects to execute arbitrary code on the server with the operating system rights of the PostgreSQL process. All versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Security researcher Mehmet Ince developed a working exploit that can crash servers and potentially escalate to remote code execution, even demonstrating it works as a 'lowest-privileged login role' on PostgreSQL 18.6. While no active exploitation has been reported, the vulnerability also affects major managed services like AWS Aurora, RDS, and Microsoft Azure PostgreSQL. Full protection requires both applying the patches and rebuilding any installed C-language extensions on the server to prevent potential compromise.

What to do: Update PostgreSQL to version 18.7, 17.12, 16.16, 15.20, or 14.25 and rebuild any installed C-language extensions.