Loading vulnerability…
Untrusted Search Path Privilege Escalation in PostgreSQL amcheck
CVE-2026-14673 is an untrusted search-path vulnerability in PostgreSQL amcheck. The extension fails to clear an untrusted search_path before processing affected expression indexes. A user granted EXECUTE privilege on an amcheck function can set a hostile search path before invoking it, causing arbitrary functions to execute with the privileges of expression-index owners whose index expressions depend on search-path resolution. Affected releases are PostgreSQL 18 before 18.6, 16 before 16.15, 15 before 15.19, and 14 before 14.24. PostgreSQL 17 is unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation crosses database privilege boundaries by executing attacker-selected functions as an affected expression-index owner. This can permit unauthorized data access or modification within that owner's privileges. The CVE-specific CVSS assessment assigns low confidentiality and integrity impacts and no availability impact; operating-system code execution is not established.
If you can’t patch tonight, do this now.
Until patched, revoke or avoid granting EXECUTE privilege on amcheck functions to untrusted roles, accounting for privileges inherited through role memberships. Limit amcheck execution to trusted administrators and review search-path-dependent expression indexes owned by elevated-privilege roles.
Patch, then assume compromise.
Upgrade the affected PostgreSQL branch to version 18.6, 16.15, 15.19, or 14.24 or later, or install the equivalent vendor security-fixed packages. PostgreSQL 17 does not require a fix for this vulnerability. For Ubuntu deployments, fixed packages include 18.6-0ubuntu0.26.04.1, 16.15-0ubuntu0.24.04.1, and 14.24-0ubuntu0.22.04.1 on their respective supported releases. Restart PostgreSQL after applying package updates so the fixes take effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.