CVE-2026-116316: PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find
Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pgtemp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are actually exposed to exploitation?
Affected deployments are those running PostgreSQL before 18.7, 17.12, 16.16, 15.20, or 14.25 where an object creator can create a domain, enum, or range type in pg_temp and a victim session later executes a query with an unqualified type name.
What must an attacker be able to do?
The attacker needs the ability to create a domain, enum, or range type in pg_temp. Exploitation also depends on a subsequent query in the same victim session using an unqualified type name, such as SELECT '1'::bigint.
Are autovacuum and other common security-restricted operations affected?
No. Autovacuum and other common users of security-restricted operations do not run queries containing unqualified type names, so they are unaffected by this issue.
How can I determine whether a session may be vulnerable?
Review security-restricted operations for sessions that can encounter attacker-created pg_temp types, then identify later queries in those same sessions that use unqualified type names. Queries that schema-qualify type names do not meet the described exploitation condition.
What is the available remediation?
Upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25, as applicable to the major version in use.