PostgreSQL says a user with permission to create database objects can execute arbitrary code as the operating system user running the database.The project published fixes on November 12, 2026, for the supported 18, 17, 16, 15, and 14 branches. The condition is object creation privilege, rather than unauthenticated access to the database.
What it allows
How Does CVE-2026-6460 Affect PostgreSQL?
PostgreSQL attributes the flaw to inadequate tracking of typed values that were not self-identifying. Stale values could remain in data dictionary entries, PL/pgSQL variables, and other parts of the system.
The project identifies a column type change as the principal route and says other data definition operations can also reach the flaw. An object creator may then execute code under the database server's operating system account. This is a privilege boundary from database object creation to the server process account.
Brandefense recommends prioritizing instances where untrusted or less trusted roles can create objects. Review object creation grants and investigate unexpected schema changes alongside database service and host activity. This defensive check follows the attack condition in PostgreSQL's advisory.
The CVE was absent from CISA's KEV catalog version 2026.11.10, which predates PostgreSQL's November 12 disclosure. That dated catalog status does not resolve whether exploitation has occurred.
Who is affected
Which PostgreSQL Versions Are Affected by CVE-2026-6460?
PostgreSQL lists affected installations in branches 18, 17, 16, 15, and 14 before their respective fixed releases. The fixed releases are 18.7, 17.12, 16.16, 15.20, and 14.25. The project also says PostgreSQL 19 RC 2 includes applicable security fixes, but 19 remains a release candidate.
Inventory the running server version on each instance and compare it with the fixed release for its own branch. Account for distribution packages that may carry a backported fix; confirm their maintainer's security notice before marking them remediated. The patch management glossary explains how to track that verification.
PostgreSQL says 14.25 is the final release of branch 14, which has reached end of life. Plan a supported major-version upgrade for production 14 deployments after applying the available fix. The vulnerability management guide can help record the migration and its completion.
Teams can use the vulnerability intelligence platform to organize exposure reviews across database assets. Confirm each instance's installed package and running server version after maintenance.
Timeline
- 2026-11-12
PostgreSQL disclosed CVE-2026-6460 and released 18.7, 17.12, 16.16, 15.20, and 14.25 as fixed versions.
- 2026-11-12
PostgreSQL announced that 14.25 is the final PostgreSQL 14 release and that the 14 branch has reached end of life.
What to do
-
Inventory affected PostgreSQL instances
Record the running major and minor version for each database server. Identify roles that can create database objects and prioritize instances with less trusted object creators.
-
Apply the fixed minor release
Update branch 18 to 18.7, 17 to 17.12, 16 to 16.16, 15 to 15.20, and 14 to 14.25 or later supported releases. For distribution packages, verify any backported fix with the maintainer.
-
Verify the running server after updating
Check the server version reported by each running instance after restart, not only the installed package version. PostgreSQL says these minor updates do not require a dump, reload, or pg_upgrade.
-
Plan the move off PostgreSQL 14
Apply 14.25 where 14 remains deployed, then schedule migration to a supported major branch. PostgreSQL states that 14.25 is the final 14 release.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What privilege does CVE-2026-6460 require?
PostgreSQL says the attacker must be able to create database objects. The advisory describes code execution as the operating system user running the database.
Which PostgreSQL releases fix CVE-2026-6460?
PostgreSQL lists 18.7, 17.12, 16.16, 15.20, and 14.25 as fixed releases for their respective branches.
Does a PostgreSQL minor update require a database dump?
PostgreSQL says its cumulative minor updates can be applied by stopping the server and updating binaries. A dump, reload, or pg_upgrade is not required for this minor update.
What should PostgreSQL 14 operators do?
Install 14.25 to address this CVE, then plan migration to a supported major version. PostgreSQL says 14.25 is the final release of branch 14.
Sources
- CVE-2026-6460 security advisoryPostgreSQL Global Development Group
- PostgreSQL November 2026 update releasePostgreSQL Global Development Group
- CVE-2026-6460 NVD recordNIST NVD
- Known Exploited Vulnerabilities CatalogCISA
