PostgreSQL fixes 52 flaws, one allows code execution
PostgreSQL updates fix 52 flaws, including CVE-2026-6460 that gives code execution to a database account. Who is affected and how to check your servers.
TL;DR: PostgreSQL has shipped updates that fix 52 security flaws. The worst is CVE-2026-6460, which gives code execution on the server to an account allowed to create objects. Update, and rebuild any C extensions.
What happened
The Hacker News reported that the PostgreSQL project released updates covering 52 security flaws. The most serious one, tracked as CVE-2026-6460, is a type confusion bug. Someone logged in with permission to create objects can abuse it to execute their own code on the host, and that code gets the rights of the operating system account that runs the database. The report gives it a CVSS score of 8.8.
One detail catches teams out: installing the new release is not the whole fix. The report says full protection also needs any extension written in C to be rebuilt against the updated server. An extension left as it was keeps the old behaviour. The reports we read do not list the fixed versions, so open the PostgreSQL project's release announcement for the exact numbers for your major version instead of guessing.
Am I affected?
The flaw needs a database account, so it matters most where many people or applications hold accounts with permission to create objects, such as shared development databases or multi-tenant services. It matters less on a database that only one trusted application can reach, but the other fixes in the release still apply there.
On one server, check the version you run and which extensions are installed:
psql -c "select version();"psql -c "select extname from pg_extension;"Then compare the version with the project's announcement, and note which extensions are compiled C code, since those need a rebuild.
How to check with Stackurity
Stackurity finds PostgreSQL on Linux servers and in container images, and PostgreSQL on AWS managed services such as RDS and Aurora, then matches it against advisories every hour. It lists the version to move to for each place the database runs, so you see every host that still needs the update, and Check again records whether it is fixed. Stackurity cannot tell you which of your C extensions need a rebuild, so check that by hand. Read about tracking fixes across servers. Start a free trial of Stackurity and list every PostgreSQL instance you run.
