Skip to content
OpenAdvisories
High · 8.8 CVE-2026-119922 EUVD-2026-116115

Babelfish for PostgreSQL Privilege Escalation

Published Nov 3, 2026 · Updated Nov 6, 2026 · Assigned by AMZN

Vendor: amazon Vendor: AWS Product: Amazon Aurora PostgreSQL with Babelfish Product: babelfish-for-postgresql

Description

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

Affected products

VendorProductAffectedFixed
AWS babelfish-for-postgresql 1.2 – ≤ 1.5, 2.1 – ≤ 2.15, 3.1 – ≤ 3.12, 4.0 – ≤ 4.8, 5.1 – ≤ 5.4 —
Amazon Amazon Aurora PostgreSQL with Babelfish 1.0.0 – < 1.5.5, 1.6.0 – < 1.17.2, 2.0.0 – < 2.3.5, 2.4.0 – < 2.12.4, 2.13.0 – < 2.13.3, 2.14.0 – < 2.14.2, 2.15.0 – < 2.15.2, 2.16.0 – < 2.16.1, 3.0.0 – < 3.8.4, 3.9.0 – < 3.9.4, 3.10.0 – < 3.10.3, 3.11.0 – < 3.11.2, 3.12.0 – < 3.12.2, 3.13.0 – < 3.13.1, 4.0.0 – < 4.5.5, 4.6.0 – < 4.6.3, 4.7.0 – <… 1.5.5

References