AZL-113765: CVE-2026-120147 affecting package postgresql 16.15-1

Q: What level of database access does an attacker need to exploit this issue?

The attacker must be able to create a database object and cause type conversion code to re-enter dblink while an outer dblink call is reading connection results. The issue is not described as requiring direct operating system access.

Q: What is the impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution as the operating system user running the PostgreSQL database server. This can extend the impact beyond the database itself to resources accessible to that operating system account.

Q: How can I determine whether my PostgreSQL version is affected?

Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. The listed postgresql package version 16.15-1 is below the fixed 16.16 release and is therefore affected.

Published Nov 12, 2026

Updated

Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-120147

Frequently Asked Questions

What level of database access does an attacker need to exploit this issue?

The attacker must be able to create a database object and cause type conversion code to re-enter dblink while an outer dblink call is reading connection results. The issue is not described as requiring direct operating system access.

What is the impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution as the operating system user running the PostgreSQL database server. This can extend the impact beyond the database itself to resources accessible to that operating system account.

How can I determine whether my PostgreSQL version is affected?

Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. The listed postgresql package version 16.15-1 is below the fixed 16.16 release and is therefore affected.

AZL-113765: CVE-2026-120147 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of database access does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

How can I determine whether my PostgreSQL version is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of database access does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

How can I determine whether my PostgreSQL version is affected?