Loading vulnerability…
Arbitrary Code Execution in PostgreSQL internal-Type Arguments
CVE-2026-14680 is a type-confusion vulnerability in PostgreSQL functions accepting arguments of the "internal" data type. This type represents mutually incompatible internal data structures that are not intended to be accessible from SQL. Gaps in safeguards intended to prevent SQL calls to these functions allow an authenticated database user to trigger type confusion and execute arbitrary code as the operating system account running PostgreSQL. Affected branches include PostgreSQL 18 before 18.6, 17 before 17.11, 16 before 16.15, 15 before 15.19, and 14 before 14.24.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A low-privileged authenticated database user can execute arbitrary code with the privileges of the PostgreSQL operating system service account, potentially compromising database confidentiality, integrity, and availability. The attacker may access or modify data and resources accessible to that account and disrupt database operations. Exploitation does not inherently grant operating system root privileges.
If you can’t patch tonight, do this now.
No vendor workaround is established. Until patches are deployed, restrict PostgreSQL network access to trusted clients and minimize access by untrusted or unnecessary database accounts. Prevent untrusted users from invoking functions accepting internal-type arguments where feasible. These measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later within the applicable branch, or install the distribution vendor's fixed PostgreSQL packages. Update the relevant installed PostgreSQL subpackages and restart PostgreSQL so the patched server code takes effect. Migrate unsupported releases to a supported, patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
76 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.