HighCVSS8.82026-11-13
CVE-2026-6460 — PostgreSQL type confusion leads to arbitrary code execution (CVSS 8.8; fixed in 18.7, 17.12, 16.16, 15.20 and 14.25): explainer and fix
Type confusion in PostgreSQL (CWE-843). The project says an object creator can execute arbitrary code as the operating system user running the database, mainly through ALTER ... SET DATA TYPE. CVSS is 8.8 and low-privilege authentication is required. Versions 14 to 18 are affected, fixed in 18.7, 17.12, 16.16, 15.20 and 14.25 (12 November 2026). The same update fixes 52 vulnerabilities in total. No exploitation is reported and there is no workaround. PostgreSQL 14 receives its final update, then reaches end of life. This site's view: apply the minor update, and if you run 14, plan your migration.