AZL-113678: CVE-2026-116303 affecting package postgresql 16.15-1
Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, tojson(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Which PostgreSQL versions are affected?
Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed package version, postgresql 16.15-1, is therefore affected.
What access does an attacker need to exploit this issue?
The attacker must be a database user and must identify access-restricted cast functions in each target database. They must also determine that a particular function implementation can expose confidential information.
Is this likely to be exploitable in a typical deployment?
The available information says there are few or no practical examples of access-restricted cast functions, or of cast functions with confidentiality impact. Exploitability therefore depends on custom or otherwise present cast functions whose execution is restricted and whose behavior can disclose sensitive data.
How can I assess whether a database is at risk before patching?
Search each database for cast functions that restrict EXECUTE access, then review whether they can be invoked through foreign keys, to_json(), or similar conversion paths. Assess the confidentiality impact of each identified function implementation.