AZL-113759: CVE-2026-120145 affecting package postgresql 16.15-1

Q: Which deployments are exposed to this issue?

Only PostgreSQL logical replication subscriptions owned by a superuser are vulnerable. Affected versions are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25.

Q: What does an attacker need to exploit the vulnerability?

The attacker must have compromised the logical-replication publisher. Exploitation relies on naming a system catalog as a replication target for a superuser-owned subscription.

Q: What is the impact if exploitation succeeds?

A compromised publisher can execute arbitrary code as the operating system user running the superuser-owned subscription.

Published Nov 12, 2026

Updated

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-120145

Frequently Asked Questions

Which deployments are exposed to this issue?

Only PostgreSQL logical replication subscriptions owned by a superuser are vulnerable. Affected versions are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25.

What does an attacker need to exploit the vulnerability?

The attacker must have compromised the logical-replication publisher. Exploitation relies on naming a system catalog as a replication target for a superuser-owned subscription.

What is the impact if exploitation succeeds?

A compromised publisher can execute arbitrary code as the operating system user running the superuser-owned subscription.

AZL-113759: CVE-2026-120145 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the impact if exploitation succeeds?