PostgreSQL CVE-2026-6460 and 51 More Flaws Fixed in November 2026 Updates — Patch Now

The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on 12 November 2026. According to the project, the update "fixes 52 security vulnerabilities and over 140 bugs." The headline flaw is CVE-2026-6460, a type confusion that, in the project's words, "allows an object creator to execute arbitrary code as the operating system user running the database." PostgreSQL, as the CNA, scores it CVSS 3.1 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

There are limits to the risk. An attacker needs a database login with permission to create objects; this is not an unauthenticated flaw. The project has not reported exploitation, CISA's enrichment of the CVE record lists exploitation as "none", and CVE-2026-6460 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The release is still a large one: 32 of the 52 fixes carry the same 8.8 score, many of them code-execution bugs. The project also says this is the final release of PostgreSQL 14 and that PostgreSQL 14 is now end of life. Organizations that run PostgreSQL should apply the update for their branch, and check whether their software and SaaS suppliers have done the same.

Technical Information

The project's CVE-2026-6460 advisory says the flaw is reachable "via ALTER ... SET DATA TYPE primarily", and that "other DDL attack routes exist." The root cause, it says, is that "the system had inadequate tracking of typed values, and values were not self-identifying," so stale values could appear "in data dictionary entries, PL/pgSQL variables, and many other parts of the system." The CVE.org record, published 12 November 2026, assigns CWE-843 (type confusion). It states the precondition: the attacker "has permission to create objects (temporary objects or non-temporary objects in at least one schema)." The flaw is in the core server.

The fix is substantial. The release notes for each branch, such as the PostgreSQL 18.7 release notes, describe "this voluminous set of patches." They add versioning logic to detect composite values that don't match the expected row layout, add locking, and tighten when ALTER COLUMN TYPE is allowed. The project credits many reporters, including several security research teams.

The other 51 fixes. The release announcement lists every CVE with its score. Thirty-one of the other 51 are also rated 8.8 (32 of the 52 in total), and none is rated higher. Many are described as able to execute arbitrary code, in areas such as PL/Perl, PL/Tcl, dblink, logical replication, text search functions and foreign data wrappers. Several affect client tools: the project lists pg_dump, pg_restore, reindexdb and vacuumdb issues that allow SQL injection or code execution. Check the announcement for the issues that apply to the extensions and tools you use.

Exploitation and KEV. The PostgreSQL advisory does not report exploitation. The CVE record's CISA ADP enrichment (12 November 2026) lists Exploitation "none" and Automatable "no". CVE-2026-6460 is not in the CISA KEV catalog (catalogVersion 2026.11.13, checked 14 November 2026 at 08:23 Asia/Jerusalem, UTC+2). NVD lists the record as Awaiting Analysis, with the PostgreSQL 8.8 score as Secondary and no NVD Primary score. This advisory does not reproduce exploit steps.

Affected Product Versions

All versions before these releases are affected by CVE-2026-6460, according to the project. PostgreSQL 19 RC 2, released the same day, includes the fixes that apply to PostgreSQL 19; the project plans general availability of PostgreSQL 19 for 19 November 2026.

PostgreSQL 14 end of life. The announcement says: "This is the final release of PostgreSQL 14. PostgreSQL 14 is now end-of-life and will no longer receive security and bug fixes." The 14.25 release notes call it "expected to be the last PostgreSQL release in the 14.X series," and the project's versioning policy lists 12 November 2026 as the final release date for 14. Teams on 14.x should install 14.25 now and plan a major-version upgrade.

Workaround and Mitigation

Update. Install the minor release for your branch. The project says that, as with other minor releases, you do not need to dump and reload or use pg_upgrade; "you may simply stop PostgreSQL and update its binaries."

Rebuild C-language extensions. The release notes for all five branches say that, for the CVE-2026-6460 fix, "for full protection, this change requires rebuilding C-language extensions, and there are some extensions that will require source-code changes." Update or rebuild compiled extensions together with the server. The notes add a new composite_type_mismatch server parameter that can turn these checks off, "but doing so carries security risks." Treat it as a temporary compatibility switch, not a fix.

Post-update steps. The project lists several, depending on what you use:

• Reindex GIN indexes you suspect are affected, pg_trgm GiST indexes, and B-tree indexes on bpchar columns declared without a length.
• If you use incremental backups, take a new full backup after updating.
• Check partitioned tables for NOT NULL NO INHERIT constraints, as described in the announcement.

Rescana guidance: the PostgreSQL project does not publish a workaround for CVE-2026-6460. Until you have updated, review which database roles can log in and create objects (the CVE record counts temporary objects too), and limit SQL access for untrusted or shared users. That includes multi-tenant platforms and applications that let customers run their own SQL.

Indicators of Compromise

Not applicable. The PostgreSQL project has published no indicators of compromise, and no exploitation has been reported. We have none to list and have not inferred any.

What to Ask Your Suppliers Today

Ask software vendors, SaaS providers and managed service providers that store or process your data in PostgreSQL:

1. Which PostgreSQL branches do you run, and have you installed the 12 November 2026 releases (18.7, 17.12, 16.16, 15.20 or 14.25)? Ask for the version and the date.
2. Have you rebuilt or updated C-language extensions alongside the server? Ask whether they rely on the composite_type_mismatch setting to disable the new checks.
3. Do any of your customers or users get direct SQL access with permission to create objects? If so, ask how that access is limited.
4. Do you still run PostgreSQL 14 or older? Ask for the upgrade plan and date.

Track incomplete answers to closure.

Need help identifying which of your suppliers run PostgreSQL and tracking whether they have applied the November 2026 updates? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• PostgreSQL security advisory for CVE-2026-6460: description, affected and fixed versions, CVSS score 8.8.
• PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released!: 12 November 2026; list of 52 CVEs with scores, PostgreSQL 14 end-of-life notice, post-update steps.
• PostgreSQL 18.7 release notes: 12 November 2026; CVE-2026-6460 fix details and C-language extension rebuild note (the same note appears in the 17.12, 16.16, 15.20 and 14.25 release notes).
• PostgreSQL 14.25 release notes: "expected to be the last PostgreSQL release in the 14.X series"; same C-language extension note.
• PostgreSQL versioning policy: lists 12 November 2026 as the PostgreSQL 14 final release.
• CVE.org record for CVE-2026-6460: PostgreSQL CNA; published 12 November 2026; CISA ADP enrichment.
• NVD record for CVE-2026-6460: Awaiting Analysis; PostgreSQL CVSS 3.1 8.8 listed as Secondary.
• CVE-2026-6460 is not in the CISA KEV catalog (catalogVersion 2026.11.13).