PostgreSQL patch fixes 52 flaws, including 22-year-old RCE

PostgreSQL released updates that fix 52 security flaws, including a long-standing type confusion bug (CVE-2026-6460) that can let a database user who can create objects run code on the server. According to The Hacker News, the project published the fixes and warns that full protection requires rebuilding any C-language extensions installed on the server.

What the reports say

The Hacker News says the type confusion bug affects composite types, which are records made from named fields. The server can end up reading stored values using the wrong type if a field's type is changed while older values still exist elsewhere on the server. That mismatch can be forced into behavior that leads to running code with the rights of the operating system user that runs PostgreSQL. The flaw is tracked as CVE-2026-6460 and carries a CVSS score of 8.8, according to the report.

Security researcher Mehmet Ince published a technical writeup showing a working exploit against PostgreSQL 18.6. The published writeup includes SQL that crashes an unpatched server and SQL that leaks memory addresses, though it does not include the final SQL that would make the server execute a command. Ince wrote that he could "trigger this crash as a lowest-privileged login role," The Hacker News reports.

The project says all versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The PostgreSQL Global Development Group has not reported any known attacks using this flaw, and the CVE record cites no observed exploitation, The Hacker News notes.

Why this matters for your organization

A successfully exploited CVE-2026-6460 can let an attacker run code with the permissions of the OS user that runs PostgreSQL. That means an offender who gains the required database access could move from SQL-level actions to operating-system level actions on the host. The Hacker News and Red Hat assessments both say the attacker needs a database login that can create or modify objects; the project advisory describes the attacker as someone with the ability to create objects, without listing exact privileges.

Many of the fixes in this release are high-severity: the project rates 32 of the 52 flaws at 8.8, the highest score in the release. One separate flaw, CVE-2026-116322, can let an unauthenticated client cause a PostgreSQL 18 server to restart, according to the project.

PostgreSQL patch: immediate actions administrators should take

Follow these steps, based on The Hacker News summary of the project advisory and release notes:

• Update PostgreSQL to the listed minor release that matches your major version: 18.7, 17.12, 16.16, 15.20, or 14.25.
• Rebuild or update every C-language extension at the same time you update the server; extensions compiled against older releases may not be protected and can require source changes.
• Update client tools on every machine that runs them, including pg_dump, pg_restore, reindexdb, and vacuumdb.
• After updating, follow the release reindexing instructions from the project and, if you use incremental backups, take a new full backup and base later incrementals on it.
• If PostgreSQL runs under a different service unit than the package expects (for example under Patroni), restart it immediately after updating.
• Do not disable the new checks using the composite_type_mismatch setting; the project warns that doing so carries security risks, The Hacker News reports.

There is no workaround offered in the project's advisory for systems that cannot be updated, per the report.

Extensions and managed services: extra care required

The Hacker News highlights that rebuilt extensions for the new minor releases may fail to load on older servers, and the project's RPM extension packages now require the new minor release. That means coordinated upgrades are important: update the server and rebuild extension binaries in the same maintenance window.

The researcher who published the exploit adapted it for managed PostgreSQL services and privately shared proofs of concept with several providers, including AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks, and Ubicloud, The Hacker News reports. The writeup does not list the current patch status for each managed service, so check with your provider for their timeline and confirmation.

What smaller teams and nontechnical owners should do next

• Ask your hosting or cloud provider whether they have applied the updates and whether any managed extension packages were rebuilt.
• If you host PostgreSQL yourself, schedule the update and extension rebuild as soon as possible, and plan for a restart and backup window.
• Have your administrator update client-side tools used for backups and restores, and follow the project's post-update reindex and backup guidance.
• If you are unsure which accounts have object-creation rights, review database roles and limit creation and schema-alter privileges to trusted administrators.

The PostgreSQL project credits a dozen or more reporters for the release, including Mehmet Ince, and the release covers fixes in client tools as well as server-side code. Treat the update and extension rebuild as a priority even when you see no evidence of active exploitation, because the public writeup demonstrates practical failure modes and partial exploits on unpatched servers.