PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code
Published Aug 13, 2026
8.8
HIGHCVSS 3.1
EPSS 0.68%
Description
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected products
- Vendor n/a Product PostgreSQL Defaultunaffected
- Version 0StatusaffectedConstraints<14.24
- Version 15StatusaffectedConstraints<15.19
- Version 16StatusaffectedConstraints<16.15
- Version 17StatusaffectedConstraints<17.11
- Version 18StatusaffectedConstraints<18.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n/a | PostgreSQL | unaffected |
|
- ≥ 14.0 · < 14.24
- ≥ 15.0 · < 15.19
- ≥ 16.0 · < 16.15
- ≥ 17.0 · < 17.11
- ≥ 18.0 · < 18.5
No data.
Red Hat Enterprise Linux 10
postgresql18-0:18.6-1.el10_2
Fixed · RHSA-2026:67280
Red Hat Enterprise Linux 9
postgresql:16-9080020260907191505.rhel9
Fixed · RHSA-2026:67491
Red Hat Enterprise Linux 9
postgresql:18-9080020260914093252.rhel9
Fixed · RHSA-2026:67848
Red Hat Enterprise Linux 10
postgresql16
Affected
Red Hat Enterprise Linux 6
postgresql
Out of support scope
Red Hat Enterprise Linux 7
postgresql
Affected
Red Hat Enterprise Linux 8
postgresql:12/postgresql
Affected
Red Hat Enterprise Linux 8
postgresql:15/postgresql
Affected
Red Hat Enterprise Linux 8
postgresql:16/postgresql
Affected
Red Hat Enterprise Linux 9
postgresql
Affected
Red Hat Enterprise Linux 9
postgresql:15/postgresql
Affected
Red Hat Hardened Images
postgresql17
Not affected
Red Hat Hardened Images
postgresql18
Not affected
Self-service automation portal 2
ansible-automation-platform/bootc-automation-portal-rhel9
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | postgresql18-0:18.6-1.el10_2 | Fixed | RHSA-2026:67280 |
| Red Hat Enterprise Linux 9 | postgresql:16-9080020260907191505.rhel9 | Fixed | RHSA-2026:67491 |
| Red Hat Enterprise Linux 9 | postgresql:18-9080020260914093252.rhel9 | Fixed | RHSA-2026:67848 |
| Red Hat Enterprise Linux 10 | postgresql16 | Affected | n/a |
| Red Hat Enterprise Linux 6 | postgresql | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | postgresql | Affected | n/a |
| Red Hat Enterprise Linux 8 | postgresql:12/postgresql | Affected | n/a |
| Red Hat Enterprise Linux 8 | postgresql:15/postgresql | Affected | n/a |
| Red Hat Enterprise Linux 8 | postgresql:16/postgresql | Affected | n/a |
| Red Hat Enterprise Linux 9 | postgresql | Affected | n/a |
| Red Hat Enterprise Linux 9 | postgresql:15/postgresql | Affected | n/a |
| Red Hat Hardened Images | postgresql17 | Not affected | n/a |
| Red Hat Hardened Images | postgresql18 | Not affected | n/a |
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This is an Important vulnerability in PostgreSQL. A type confusion flaw in the cursor lifecycle allows a low-privileged authenticated database user to execute arbitrary code as the operating system user running the database. This can lead to a complete compromise of the database system, making it a significant risk in typical Red Hat deployments where PostgreSQL instances are exposed to authenticated users.
Red Hat mitigation
To mitigate this vulnerability, restrict direct database access strictly to trusted roles and minimize multi-tenant database scenarios where untrusted users can execute arbitrary SQL. Monitor database audit logs for anomalous or high-frequency cursor lifecycle activities involving unexpected CLOSE and DECLARE operations.
References (6)
- https://access.redhat.com/security/cve/CVE-2026-16239 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515316 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57849 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16239
- https://www.cve.org/CVERecord?id=CVE-2026-16239
- https://www.postgresql.org/support/security/CVE-2026-16239/ Vendor Advisory
Change history (0)
No recorded changes yet.