Executive brief
PostgreSQL is a widely used database system for storing and managing corporate data. A security flaw in how the database handles the creation of custom data types allows a low-privileged user to trick other users, including administrators, into running malicious code. This could lead to unauthorized data access or the execution of unintended database commands when other users perform routine queries.
Technical details
A missing authorization check in the PostgreSQL 'CREATE TYPE' command fails to verify 'CREATE' privileges on schemas when defining multirange types. An attacker with basic database access can create a malicious type that shadows a legitimate user-defined or extension-defined type. When a victim (such as a database administrator) executes a query that relies on the 'search_path' to resolve types, the database may resolve to the attacker's type and execute associated malicious SQL functions. This vulnerability is fixed in PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL PostgreSQL < 18.4, < 17.10, < 16.14, < 15.18, < 14.23
Timeline
- 2026-05-14: disclosed
- 2026-05-14: patched
- 2026-05-14: advisory