PostgreSQL Patches 52 Flaws Including 22-Year-Old Bug Enabling Authenticated RCE
The PostgreSQL Global Development Group has released updates addressing 52 security vulnerabilities, one of which is a type confusion flaw dating back to 2004 that allows authenticated remote code execution. Tracked as CVE-2026-6460 with a CVSS score of 8.8, the issue affects composite types and can be exploited by users with object creation privileges. Researcher Mehmet Ince published a working exploit that involves preparing queries, altering field types, and triggering memory operations leading to code execution. All versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are impacted, and administrators must also rebuild C-language extensions. Additional fixes cover client tools such as pg_restore and psql, while one unauthenticated flaw can restart PostgreSQL 18 servers. No in-the-wild exploitation has been observed according to CISA and project assessments.
The Hacker NewsNov 13, 2026Translated from English