ALPINE-CVE-2026-116316: High severity alpine/postgresql15 vulnerability
Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pgtemp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments are exposed if they run PostgreSQL before 18.7, 17.12, 16.16, 15.20, or 14.25 and a security-restricted operation can later execute a query with an unqualified type name. Common users of security-restricted operations, including autovacuum, are not affected because they do not issue such queries.
What must an attacker be able to do?
The attacker must be able to create a domain, enum, or range type in pg_temp. They also need a victim session to subsequently run a query containing an unqualified type name, such as SELECT '1'::bigint.
What is the impact if exploitation succeeds?
An object creator can execute arbitrary SQL with the privileges of the caller of the security-restricted operation. This can affect confidentiality, integrity, and availability.