AZL-113708: CVE-2026-116316 affecting package postgresql 16.15-1

Q: Which deployments are exposed to this issue?

PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed package version, postgresql 16.15-1, is therefore affected.

Q: What must an attacker and victim session do for exploitation to succeed?

An attacker must be able to create a domain, enum, or range type in pg_temp. A later security-restricted operation running in the victim session must execute a query that uses an unqualified type name, such as SELECT '1'::bigint, allowing arbitrary SQL to run as that operation's caller.

Q: Are autovacuum jobs affected?

No. Autovacuum and other common users of security-restricted operations do not run queries with unqualified type names and are unaffected.

Q: What version should be used to remediate the issue?

Upgrade to PostgreSQL 16.16 or later for the 16.x release line. Fixed versions are also 18.7, 17.12, 15.20, and 14.25 for their respective release lines.

Published Nov 12, 2026

Updated

Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pgtemp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116316

Frequently Asked Questions

Which deployments are exposed to this issue?

PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed package version, postgresql 16.15-1, is therefore affected.

What must an attacker and victim session do for exploitation to succeed?

An attacker must be able to create a domain, enum, or range type in pg_temp. A later security-restricted operation running in the victim session must execute a query that uses an unqualified type name, such as SELECT '1'::bigint, allowing arbitrary SQL to run as that operation's caller.

Are autovacuum jobs affected?

No. Autovacuum and other common users of security-restricted operations do not run queries with unqualified type names and are unaffected.

What version should be used to remediate the issue?

Upgrade to PostgreSQL 16.16 or later for the 16.x release line. Fixed versions are also 18.7, 17.12, 15.20, and 14.25 for their respective release lines.

AZL-113708: CVE-2026-116316 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker and victim session do for exploitation to succeed?

Are autovacuum jobs affected?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker and victim session do for exploitation to succeed?

Are autovacuum jobs affected?

What version should be used to remediate the issue?