PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5983 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PostgreSQL Server Process Spawning Shell or Interpreter (CVE-2026-6460 Post-Exploitation)

Detects the postgres/postmaster process spawning a shell, scripting interpreter or download/networking utility, the expected post-exploitation outcome of CVE-2026-6460 where an object creator executes code as the OS user running PostgreSQL. Arguments such as /dev/tcp, mkfifo, base64 -d, chmod +x, curl or wget raise severity to critical.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.004, T1068, T1203
• Data sources: Sysmon for Linux (sysmon:linux EventCode 1), Microsoft Defender for Endpoint (DeviceProcessEvents), auditd
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
| where match(ParentImage,"/(postgres|postmaster)$") AND match(Image,"/(sh|bash|dash|zsh|python[0-9.]*|perl|ruby|php|nc|ncat|socat|curl|wget|busybox)$")
| eval suspicious_args=if(match(CommandLine,"(?i)(/dev/tcp/|mkfifo|base64 -d|chmod [+]x|curl |wget )"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentCommandLine) as parent_cmdline max(suspicious_args) as suspicious_args by host User ParentImage Image
| eval severity=if(suspicious_args=1,"critical","high")
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentImage Image cmdlines parent_cmdline count severity

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ('postgres', 'postmaster')
| where FileName in~ ('sh', 'bash', 'dash', 'zsh', 'python', 'python3', 'perl', 'ruby', 'php', 'nc', 'ncat', 'socat', 'curl', 'wget', 'busybox')
| extend SuspiciousArgs = ProcessCommandLine matches regex @'(?i)(/dev/tcp/|mkfifo|base64\s+-d|chmod\s+\+x|curl\s|wget\s)'
| extend Risk = iff(SuspiciousArgs, 'critical', 'high')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Risk

Sigma

title: PostgreSQL Server Process Spawns Shell or Interpreter
id: 0b8d4e72-91a3-4c5f-8e26-7d3f1a6b2c02
status: experimental
description: Detects the PostgreSQL server (postgres/postmaster) spawning a shell, scripting interpreter or download utility, consistent with code execution following exploitation of CVE-2026-6460.
references:
  - https://www.postgresql.org/support/security/CVE-2026-6460/
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.execution
  - attack.t1059.004
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1203
  - cve.2026-6460
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/postgres'
      - '/postmaster'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/perl'
      - '/ruby'
      - '/php'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - archive_command, restore_command or COPY ... PROGRAM configured by administrators
  - Backup or HA tooling invoked by postgres (pgBackRest, WAL-G, Patroni callbacks)
level: high

Known false positives:

• archive_command / restore_command or COPY ... PROGRAM intentionally configured by DBAs
• Backup and HA tooling (pgBackRest, WAL-G, Patroni callbacks) launched by the postgres process

Tuning notes: Allow-list known archive_command/restore_command command lines per host (match on ParentCommandLine). Keep curl/wget/nc/socat/bash -i style arguments as critical. Ensure Sysmon for Linux or MDE sensor covers every database host.

• 🔒 PostgreSQL CVE-2026-6460 Alternate Trigger - ADD COLUMN, ROLLBACK, ADD COLUMN Pattern · unlock with TL Creds
• 🔒 PostgreSQL Client Tool Abuse - pg_restore / pg_dump / psql Spawning Shells or Loading [indicator] · unlock with TL Creds
• 🔒 PostgreSQL vacuumdb --missing-stats-only and Maintenance Tool Child Process Abuse (CVE-2026-116313) · unlock with TL Creds
• 🔒 PostgreSQL Composite Type Creation or Attribute Alteration by Non-Administrative Role · unlock with TL Creds
• 🔒 PostgreSQL Client Backend Terminated by Signal 11 (Failed CVE-2026-6460 Exploitation) · unlock with TL Creds
• 🔒 PostgreSQL composite_type_mismatch Safety Check Setting Modified · unlock with TL Creds
• 🔒 PostgreSQL CVE-2026-6460 Composite Type Confusion - ALTER TYPE ALTER ATTRIBUTE Sequence · unlock with TL Creds
• 🔒 PostgreSQL Server Process Outbound Connection to Public Address (CVE-2026-6460 C2 / Callback) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5983.

Technical analysis

A researcher writeup demonstrates a crash and memory-address leak on 18.6 while withholding the final code-execution step; no in-the-wild exploitation is reported.

CVE-2026-6460 is a type confusion flaw in the PostgreSQL core server. The project advisory states that an object creator can execute arbitrary code as the operating-system user running the database, primarily via ALTER ... SET DATA TYPE; other DDL routes exist, such as ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN. The root cause is inadequate tracking of typed values: values are not self-identifying, so stale values can remain in data dictionary entries, PL/pgSQL variables and other server structures after a composite type's attribute type is changed. The server then interprets old bytes under the new type. The upstream fix adds versioning of composite attributes so the server can detect a value that no longer matches its type; full protection also requires rebuilding C-language extensions against the new release.

Security researcher Mehmet Ince published a technical writeup (part 3 of a series) demonstrating a working exploit on PostgreSQL 18.6. The primitive is: create a composite type, prepare a statement that returns a value of that type, change an attribute's type (for example uuid to bytea, or a uuid[] carrier element type to bigint[]) and then execute the prepared statement. This makes a backend dereference an attacker-influenced pointer, crashing the client backend with signal 11, and a variant leaks a pointer value as an integer, defeating ASLR. The final step that turns this into command execution is withheld. According to the writeup the mutable row-type behaviour traces to a 5 May 2004 commit and the abused expanded-object callback mechanism to a 14 May 2015 change. Ince reports the crash path is reachable by a low-privileged login role; whether default-privilege accounts can reach code execution is not confirmed by the sources. Ince privately shared PoCs with managed PostgreSQL providers in mid-August 2026 (AWS Aurora/RDS, Azure, Google AlloyDB, Supabase, Databricks, Ubicloud, ClickHouse) and reports every managed platform he tested was affected; some providers deployed mitigations ahead of the upstream release. Six CVEs are linked to this issue: CVE-2026-6460 (umbrella fix), CVE-2026-120142, CVE-2026-120148, CVE-2026-116329, CVE-2026-116306 and CVE-2026-120139.

The release (PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25 and 19 RC 2, 12 Nov 2026) fixes 52 CVEs, 32 of them rated CVSS 8.8, many being type confusion, use-after-free or integer-wraparound bugs that execute arbitrary code (PL/Perl, PL/Tcl, dblink, plpgsql, statistics import, etc.). Client-tool flaws include CVE-2026-116314 (pg_restore executes arbitrary code due to missing non-plain archive validation), CVE-2026-116330 (pg_dump tar restore.sql fails to block psql command injection, user interaction required), CVE-2026-116318 (pg_dump SQL injection via not-null constraint name), CVE-2026-116325 (reindexdb quoting SQL injection) and CVE-2026-116313 (vacuumdb --missing-stats-only lets a database owner run code as the vacuumdb user). CVE-2026-116322 is a pre-authentication cancel request that can leak a spinlock (CVSS 5.3, low availability impact); the press article describes it as letting an unauthenticated client restart PostgreSQL 18 servers. No exploitation in the wild is reported by the PostgreSQL project and CISA's CVE record lists exploitation as none. No workaround exists for unpatched servers; the project warns against disabling the new checks with the composite_type_mismatch setting. PostgreSQL 14 reaches end-of-life with 14.25, and older unsupported majors receive no fix.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Remediation

Patches

• PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25 (released 2026-11-12)
• Rebuild or update all C-language extensions against the new minor release; RPM extension packages require the new minor release
• Follow post-update reindexing steps and take a new full backup before further incremental backups

Immediate actions

• Update PostgreSQL to 18.7, 17.12, 16.16, 15.20 or 14.25 (or your managed provider's patched release)
• Restart PostgreSQL after updating if it runs outside its package service unit (for example under Patroni)
• Update pg_dump, pg_restore, psql, reindexdb and vacuumdb on every machine that runs them
• Do not disable the new checks via the composite_type_mismatch setting

Workarounds

• No workaround is documented for servers that cannot be updated; limit who can create objects and alter types as a risk reduction

Longer-term hardening

• Restrict CREATE TYPE / ALTER TYPE and object-creation privileges to trusted roles
• Alert on postgres client backend signal 11 crashes and ALTER TYPE ... ALTER ATTRIBUTE statements
• Migrate off PostgreSQL 14 and other unsupported majors
• Only restore archives and dumps from trusted sources

Affected and fixed versions

• PostgreSQL Global Development Group — PostgreSQL
  Vulnerable versions: All versions before 18.7; All versions before 17.12; All versions before 16.16; All versions before 15.20; All versions before 14.25
  Fixed in: 18.7; 17.12; 16.16; 15.20; 14.25
• Managed PostgreSQL providers — AWS Aurora/RDS, Azure PostgreSQL, Google AlloyDB, Supabase, Databricks, Ubicloud
  Vulnerable versions: Per researcher testing; patch status not stated
  Fixed in: Provider-specific mitigations/patches

Timeline

• 2004-05-05 PostgreSQL gains the ability to change a column/attribute type; the researcher traces the root cause of the type-confusion primitive to this commit
• 2015-05-14 Expanded-object callback change that the code-execution technique relies on lands in PostgreSQL
• 2026-06-23 Approximate: separate pg_clickhouse issue reported to its vendor and fixed during the researcher's investigation
• 2026-07-31 Approximate (late July to early August 2026): researcher Mehmet Ince finds the core composite-type confusion primitive
• 2026-08-15 Approximate (mid-August 2026): reproducible PoCs shared privately with managed PostgreSQL providers including AWS, Azure, Google AlloyDB, Supabase and Databricks; ClickHouse and Ubicloud engaged in late August
• 2026-11-09 Upstream security commits land, including composite attribute versioning for CVE-2026-6460 and five linked CVEs
• 2026-11-12 Mehmet Ince publishes technical writeup with crash and memory-leak steps on PostgreSQL 18.6; final code-execution step withheld
• 2026-11-12 PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25 and 19 RC 2 released fixing 52 CVEs; PostgreSQL 14 reaches end-of-life
• 2026-11-13 The Hacker News reports the release; no exploitation in the wild reported and CISA CVE record lists exploitation as none

Sources cited

• PostgreSQL Security Advisory: CVE-2026-6460 postgresql.org · Advisory · 2026-11-12
• PostgreSQL Security Information index postgresql.org · Advisory · 2026-11-12
• PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25 and 19 RC 2 Released postgresql.org · Vendor report · 2026-11-12
• Mehmet Ince: Turning a 22-year-old PostgreSQL type confusion primitive into RCE (CVE-2026-6460) mehmetince.net · Research · 2026-11-12
• PostgreSQL 18.7 Release Notes postgresql.org · Vendor report · 2026-11-12
• Red Hat CVE-2026-6460 access.redhat.com · Vendor report · 2026-11-12
• yum.postgresql.org: extensions require the new minor release yum.postgresql.org · Vendor report · 2026-11-12
• PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE The Hacker News · News · 2026-11-13

More in vulnerability

• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)
• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi