ALPINE-CVE-2026-120146: Medium severity alpine/postgresql15 vulnerability
Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL releases need to be updated?
Affected releases are PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What access does an attacker need to exploit this issue?
The attacker needs an authenticated PostgreSQL role with the relevant granted-role relationship: it has INHERIT for a role but lacks SET for that role. Exploitation does not require user interaction.
What unauthorized actions become possible?
The role can use REASSIGN OWNED to transfer objects to the granted role despite not having SET permission. It can also reassign database ownership without the CREATEDB privilege.
Is this limited to REASSIGN OWNED?
Yes, the described authorization bypass concerns PostgreSQL REASSIGN OWNED. Equivalent ALTER ... OWNER commands enforce the relevant checks and block these actions.