Description
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PostgreSQL | 18 – < 18.4, 17 – < 17.10, 16 – < 16.14, 15 – < 15.18, < 14.23 | 18.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgresql-18 | 18.4-1 | — |
| Debian 13 | postgresql-17 | 17.10-0+deb13u1 | — |
| Debian 12 | postgresql-15 | 15.18-0+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | postgresql-18 | 18.4-0ubuntu0.26.04.1 | — |
| Ubuntu 25.10 | postgresql-17 | 17.10-0ubuntu0.25.10.1 | — |
| Ubuntu 24.04 LTS | postgresql-16 | 16.14-0ubuntu0.24.04.1 | — |
| Ubuntu 22.04 LTS | postgresql-14 | 14.23-0ubuntu0.22.04.1 | — |
| Ubuntu 20.04 LTS | postgresql-12 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | postgresql-10 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | postgresql-9.5 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | postgresql-9.3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | postgresql +15 | 16.14-1.el10_2 | RHSA-2026:27743 |
| RHEL 10 | postgresql18 +13 | 18.4-1.el10_2 | RHSA-2026:27742 |
| RHEL 9 | pg_repack | 1.4.8-2.module+el9.8.0+24091+17775505 | RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203 |
| RHEL 9 | pgaudit | 1.7.0-1.module+el9.8.0+24091+17775505 | RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203 |
| RHEL 9 | pgvector | 0.6.2-2.module+el9.8.0+24090+8f0ee565 | RHSA-2026:26204, RHSA-2026:26203 |
| RHEL 9 | postgis +4 | 3.5.3-5.module+el9.8.0+24090+8f0ee565 | RHSA-2026:26204, RHSA-2026:26203 |
| RHEL 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.8.0+24091+17775505 | RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203 |
| RHEL 9 | postgresql +14 | 15.18-1.module+el9.8.0+24358+32c5830e | RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203 |
| RHEL 8 | pg_repack | 1.4.8-1.module+el8.9.0+19797+c4ce5969 | RHSA-2026:28143, RHSA-2026:26181 |
| RHEL 8 | pgaudit | 1.7.0-1.module+el8.9.0+19797+c4ce5969 | RHSA-2026:28143, RHSA-2026:26181 |
| RHEL 8 | postgres-decoderbufs | 1.9.7-1.Final.module+el8.9.0+19797+c4ce5969 | RHSA-2026:28143, RHSA-2026:26181 |
| RHEL 8 | postgresql +14 | 15.18-1.module+el8.10.0+24361+29e043a0 | RHSA-2026:28143, RHSA-2026:26181 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | postgresql +15 | 16.14-1.el10_0 | RHSA-2026:27718 |
| RHEL 9.6 EUS | pg_repack | 1.4.8-2.module+el9.5.0+22224+f5585c78 | RHSA-2026:32983, RHSA-2026:26525 |
| RHEL 9.6 EUS | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:32983, RHSA-2026:26525 |
| RHEL 9.6 EUS | pgvector | 0.6.2-2.module+el9.6.0+22979+c3d78d52 | RHSA-2026:26525 |
| RHEL 9.6 EUS | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:32983, RHSA-2026:26525 |
| RHEL 9.6 EUS | postgresql +14 | 15.18-1.module+el9.6.0+24427+6664975e | RHSA-2026:32983, RHSA-2026:26525 |
| RHEL 9.4 E4S | pg_repack | 1.4.8-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:33441, RHSA-2026:26524 |
| RHEL 9.4 E4S | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:33441, RHSA-2026:26524 |
| RHEL 9.4 E4S | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:33441, RHSA-2026:26524 |
| RHEL 9.4 E4S | postgresql +14 | 15.18-1.module+el9.4.0+24401+d70df5dc | RHSA-2026:33441, RHSA-2026:26524 |
| RHEL 9.2 E4S | pg_repack | 1.4.8-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:33497 |
| RHEL 9.2 E4S | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:33497 |
| RHEL 9.2 E4S | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:33497 |
| RHEL 9.2 E4S | postgresql +14 | 15.18-1.module+el9.2.0+24451+e803ec54 | RHSA-2026:33497 |
| RHEL 8.8 TUS | pg_repack | 1.4.8-1.module+el8.8.0+17071+aaaceaa4 | RHSA-2026:26561 |
| RHEL 8.8 TUS | pgaudit | 1.7.0-1.module+el8.8.0+17071+aaaceaa4 | RHSA-2026:26561 |
| RHEL 8.8 TUS | postgres-decoderbufs | 1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4 | RHSA-2026:26561 |
| RHEL 8.8 TUS | postgresql +14 | 15.18-1.module+el8.8.0+24395+e7b9b4b6 | RHSA-2026:26561 |
| RHEL 8.8 E4S | pg_repack | 1.4.8-1.module+el8.8.0+17071+aaaceaa4 | RHSA-2026:26561 |
| RHEL 8.8 E4S | pgaudit | 1.7.0-1.module+el8.8.0+17071+aaaceaa4 | RHSA-2026:26561 |
| RHEL 8.8 E4S | postgres-decoderbufs | 1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4 | RHSA-2026:26561 |
| RHEL 8.8 E4S | postgresql +14 | 15.18-1.module+el8.8.0+24395+e7b9b4b6 | RHSA-2026:26561 |
| Red Hat Hardened Images 1 | postgresql +14 | 18.4-0.1.hum1 | RHSA-2026:22878 |
| Red Hat Hardened Images 1 | postgresql17 +14 | 17.10-0.1.hum1 | RHSA-2026:21182 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | postgresql +14 | 16.14-1.el10_2 | ALSA-2026:27743 |
| AlmaLinux 10 | postgresql18 +13 | 18.4-1.el10_2 | ALSA-2026:27742 |
| AlmaLinux 9 | pg_repack | 1.4.8-2.module_el9.5.0+119+18833d03 | ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203 |
| AlmaLinux 9 | pgaudit | 1.7.0-1.module_el9.3.0+52+21733919 | ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203 |
| AlmaLinux 9 | pgvector | 0.6.2-2.module_el9.6.0+167+4e561146 | ALSA-2026:26204, ALSA-2026:26203 |
| AlmaLinux 9 | postgis +4 | 3.5.3-5.module_el9.8.0+236+2d3cbd4c | ALSA-2026:26204, ALSA-2026:26203 |
| AlmaLinux 9 | postgres-decoderbufs | 1.9.7-1.Final.module_el9.3.0+52+21733919 | ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203 |
| AlmaLinux 9 | postgresql +14 | 15.18-1.module_el9.8.0+267+7c71b4a4 | ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203 |
| AlmaLinux 8 | pg_repack | 1.4.8-1.module_el8.9.0+3706+885c732e | ALSA-2026:28143, ALSA-2026:26181 |
| AlmaLinux 8 | pgaudit | 1.7.0-1.module_el8.9.0+3706+885c732e | ALSA-2026:28143, ALSA-2026:26181 |
| AlmaLinux 8 | postgres-decoderbufs | 1.9.7-1.Final.module_el8.9.0+3706+885c732e | ALSA-2026:28143, ALSA-2026:26181 |
| AlmaLinux 8 | postgresql +14 | 15.18-1.module_el8.10.0+4195+4569d728 | ALSA-2026:28143, ALSA-2026:26181 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | postgresql14 | 14.23-160000.1.1 | SUSE-SU-2026:22177-1 |
| SLES for SAP 16.0 | postgresql15 | 15.18-160000.1.1 | SUSE-SU-2026:22183-1 |
| SLES for SAP 16.0 | postgresql16 | 16.14-160000.1.1 | SUSE-SU-2026:22184-1 |
| SLES for SAP 16.0 | postgresql17 | 17.10-160000.1.1 | SUSE-SU-2026:22149-1 |
| SLES for SAP 16.0 | postgresql18 | 18.4-160000.1.1 | SUSE-SU-2026:22077-1 |
| SLES 16.0 | postgresql14 | 14.23-160000.1.1 | SUSE-SU-2026:22177-1 |
| SLES 16.0 | postgresql15 | 15.18-160000.1.1 | SUSE-SU-2026:22183-1 |
| SLES 16.0 | postgresql16 | 16.14-160000.1.1 | SUSE-SU-2026:22184-1 |
| SLES 16.0 | postgresql17 | 17.10-160000.1.1 | SUSE-SU-2026:22149-1 |
| SLES 16.0 | postgresql18 | 18.4-160000.1.1 | SUSE-SU-2026:22077-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql14 | 14.23-1.1 | openSUSE-SU-2026:10806-1 |
| openSUSE Tumbleweed | postgresql15 | 15.18-1.1 | openSUSE-SU-2026:10807-1 |
| openSUSE Tumbleweed | postgresql16 | 16.14-1.1 | openSUSE-SU-2026:10808-1 |
| openSUSE Tumbleweed | postgresql17 | 17.10-1.1 | openSUSE-SU-2026:10809-1 |
| openSUSE Tumbleweed | postgresql18 | 18.4-1.1 | openSUSE-SU-2026:10828-1 |
| openSUSE Leap 16.0 | postgresql14 | 14.23-160000.1.1 | openSUSE-SU-2026:21102-1 |
| openSUSE Leap 16.0 | postgresql15 | 15.18-160000.1.1 | openSUSE-SU-2026:21103-1 |
| openSUSE Leap 16.0 | postgresql16 | 16.14-160000.1.1 | openSUSE-SU-2026:21104-1 |
| openSUSE Leap 16.0 | postgresql17 | 17.10-160000.1.1 | openSUSE-SU-2026:20970-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | postgresql16 | 16.14-r0 | — |
| Alpine v3.24 | postgresql17 | 17.10-r0 | — |
| Alpine v3.24 | postgresql18 | 18.4-r0 | — |
| Alpine v3.23 | postgresql16 | 16.14-r0 | — |
| Alpine v3.23 | postgresql17 | 17.10-r0 | — |
| Alpine v3.23 | postgresql18 | 18.4-r0 | — |
| Alpine v3.22 | postgresql15 | 15.18-r0 | — |
| Alpine v3.22 | postgresql16 | 16.14-r0 | — |
| Alpine v3.22 | postgresql17 | 17.10-r0 | — |
| Alpine v3.21 | postgresql15 | 15.18-r0 | — |
| Alpine v3.21 | postgresql16 | 16.14-r0 | — |
| Alpine v3.21 | postgresql17 | 17.10-r0 | — |
| Alpine v3.20 | postgresql15 | 15.18-r0 | — |
| Alpine v3.20 | postgresql16 | 16.14-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | postgresql15 +15 | 15.18-1.amzn2023.0.1 | ALAS2023-2026-1768 |
| Amazon Linux 2023 | postgresql16 +15 | 16.14-1.amzn2023.0.1 | ALAS2023-2026-1767 |
| Amazon Linux 2023 | postgresql17 +15 | 17.10-1.amzn2023.0.1 | ALAS2023-2026-1766 |
| Amazon Linux 2023 | postgresql18 +15 | 18.4-1.amzn2023.0.1 | ALAS2023-2026-1780 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | postgresql | 16.14-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | postgresql18 +13 | 18.4-1.0.1.el10_2 | ELSA-2026-27742 |
Advisories 46
- ALSA-2026:27742 Important: postgresql18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:27743 Important: postgresql16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26203 Important: postgresql:16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26204 Important: postgresql:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28037 Important: postgresql:15 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:28143 Important: postgresql:16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26181 Important: postgresql:15 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1544 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- WID-SEC-2026-2929 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:33497 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:33441 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:32983 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:28037 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:27742 Red Hat Security Advisory: postgresql18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:27743 Red Hat Security Advisory: postgresql16 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:27718 Red Hat Security Advisory: postgresql16 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26561 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26524 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26525 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26204 Red Hat Security Advisory: postgresql:18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26203 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:28143 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RHSA-2026:26181 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RHSA-2026:21182 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:22878 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-2858 IBM AIX und VIOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- NCSC-2026-0321 Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOS NCSC-NL (Netherlands) · Aug 21, 2026
- ELSA-2026-27742 Important: postgresql18 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- openSUSE-SU-2026:21103-1 Security update for postgresql15 SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:21104-1 Security update for postgresql16 SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:21102-1 Security update for postgresql14 SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22184-1 Security update for postgresql16 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22183-1 Security update for postgresql15 SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:20970-1 Security update for postgresql17 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22177-1 Security update for postgresql14 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22149-1 Security update for postgresql17 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22077-1 Security update for postgresql18 SUSE / openSUSE Security Updates · Jun 16, 2026
- ALAS2023-2026-1780 Important: postgresql18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- ALAS2023-2026-1766 Important: postgresql17 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
- ALAS2023-2026-1767 Important: postgresql16 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
- ALAS2023-2026-1768 Important: postgresql15 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
- openSUSE-SU-2026:10828-1 libecpg6-18.4-1.1 on GA media SUSE / openSUSE Security Updates · May 21, 2026
- openSUSE-SU-2026:10808-1 postgresql16-16.14-1.1 on GA media SUSE / openSUSE Security Updates · May 19, 2026
- openSUSE-SU-2026:10809-1 postgresql17-17.10-1.1 on GA media SUSE / openSUSE Security Updates · May 19, 2026
- openSUSE-SU-2026:10806-1 postgresql14-14.23-1.1 on GA media SUSE / openSUSE Security Updates · May 19, 2026
- openSUSE-SU-2026:10807-1 postgresql15-15.18-1.1 on GA media SUSE / openSUSE Security Updates · May 19, 2026