CVE-2026-6460

CVE-2026-6460 is a type confusion vulnerability in the PostgreSQL core database engine that stems from inadequate tracking of typed values. Because stored values do not carry self-identifying type information, stale values can persist in data dictionary entries, PL/pgSQL variables, and other parts of the system. An authenticated user with object-creation privileges—which can include the default permission to create temporary objects—can trigger this flaw using Data Definition Language (DDL) commands, such as altering column data types (e.g., `ALTER ... SET DATA TYPE`). By manipulating these types, an attacker can execute arbitrary code on the host system with the privileges of the operating system user running the database service. The vulnerability, which security researcher Mehmet Ince traced back to a 22-year-old design choice in PostgreSQL's core, was patched on November 12, 2026. The PostgreSQL Global Development Group addressed the issue in versions 18.7, 17.12, 16.16, 15.20, and 14.25 by introducing version checks to ensure stored values match their expected types. To achieve full protection, administrators must not only update their database binaries but also rebuild any installed C-language extensions, as older compiled extensions may lack the necessary type-checking mechanisms.