CVEs / CVE-2026-6460

CVE-2026-6460: n/a PostgreSQL vulnerability

high 8.8 CVSS 3.1 (from the CNA)
EPSS 0.59% chance of exploitation in the next 30 days, higher than 48% of CVEs (14 Nov 2026)
Last changed at its sources 13 Nov 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-6460

Description

Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
The CVE record, via NVD · published 12 Nov 2026 · NVD status: Awaiting Analysis

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a PostgreSQL	from 18, before 18.7	18.7
n/a PostgreSQL	from 17, before 17.12	17.12
n/a PostgreSQL	from 16, before 16.16	16.16
n/a PostgreSQL	from 15, before 15.20	15.20
n/a PostgreSQL	before 14.25	14.25

Exploitation

Not in the CISA Known Exploited Vulnerabilities catalog as of 13 Nov 2026.

Severity

CVSS 3.1	8.8 high `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Scored by the CNA (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
Weakness	CWE-843

On the Stackurity blog

PostgreSQL fixes 52 flaws, one allows code execution 14 Nov 2026

References

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.