UBUNTU-CVE-2026-6460: High severity ubuntu/postgresql-9.3 vulnerability
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue, and what level of access is required?
An attacker needs an existing database account with low privileges and the ability to create database objects. The issue is reachable over the network without user interaction, and exploitation can result in code execution as the operating system user running PostgreSQL.
Which PostgreSQL releases need to be updated?
Affected releases are versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Systems running the listed Ubuntu PostgreSQL packages should be checked against these fixed release levels.
What actions can trigger exploitation?
The primary described route uses ALTER ... SET DATA TYPE. Other DDL sequences can also trigger the flaw, including adding a column, rolling back, and then adding a column again.
What can be done while an update is pending?
Limit untrusted or low-privileged database users from creating objects or performing relevant DDL where operationally possible. The provided information does not identify a complete workaround, so updating to a fixed release remains necessary.