AZL-113804: CVE-2026-6467 affecting package postgresql 16.15-1

Q: Who can exploit this issue?

An attacker needs database-level CREATE privilege. Successful exploitation can execute arbitrary code as the bootstrap superuser.

Q: Are PostgreSQL 16.15-1 installations affected?

Yes. PostgreSQL versions before 16.16 are affected, so the listed 16.15-1 package falls within the affected version range.

Q: Which PostgreSQL operations are involved?

The issue can be triggered through CREATE EXTENSION, including CREATE EXTENSION ... SCHEMA "$user", and through ALTER EXTENSION. ALTER SCHEMA ... RENAME can be used in the attack path.

Q: What versions contain the fix?

The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25, respectively.

Published Nov 12, 2026

Updated

Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-6467

Frequently Asked Questions

Who can exploit this issue?

An attacker needs database-level CREATE privilege. Successful exploitation can execute arbitrary code as the bootstrap superuser.

Are PostgreSQL 16.15-1 installations affected?

Yes. PostgreSQL versions before 16.16 are affected, so the listed 16.15-1 package falls within the affected version range.

Which PostgreSQL operations are involved?

The issue can be triggered through CREATE EXTENSION, including CREATE EXTENSION ... SCHEMA "$user", and through ALTER EXTENSION. ALTER SCHEMA ... RENAME can be used in the attack path.

What versions contain the fix?

The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25, respectively.

AZL-113804: CVE-2026-6467 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

Are PostgreSQL 16.15-1 installations affected?

Which PostgreSQL operations are involved?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are PostgreSQL 16.15-1 installations affected?

Which PostgreSQL operations are involved?

What versions contain the fix?