ALPINE-CVE-2026-6467: High severity alpine/postgresql15 vulnerability
Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs database-level CREATE privilege. They can use ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user" to cause a trusted extension script to resolve and execute an attacker-controlled object.
What is the impact of successful exploitation?
Successful exploitation can execute arbitrary code as the PostgreSQL bootstrap superuser. This can compromise confidentiality, integrity, and availability.
Which PostgreSQL versions need remediation?
Versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Alpine PostgreSQL 15, 16, 17, and 18 packages should be updated to their corresponding fixed version or later.
How can I reduce exposure before updating?
Restrict database-level CREATE privilege to trusted users, since exploiting the issue requires that privilege. Review who can create extensions or alter schemas and remove unnecessary access.