CVE-2026-14673 in PostgreSQL
Summary
by MITRE • 08/13/2026
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a sophisticated privilege escalation mechanism within PostgreSQL's amcheck function that leverages insecure search path handling to enable unauthorized code execution. The flaw exists in the way PostgreSQL processes expression indexes during amcheck operations, where the database engine fails to properly sanitize the search path environment before executing dependent functions. When a user possesses the EXECUTE privilege on the amcheck function, they can manipulate the database's search path to point to malicious schemas or functions, effectively allowing them to execute arbitrary code with the privileges of the expression index owners.
The technical exploitation occurs through a specific sequence where an attacker first sets up a hostile search path containing malicious functions, then invokes the amcheck function which subsequently processes expression indexes. The database engine's failure to isolate or properly validate the search path context creates an opportunity for privilege escalation attacks that can potentially compromise the entire database system. This vulnerability directly maps to CWE-276, which describes inadequate privileges in software systems, and specifically demonstrates improper privilege handling within database query execution contexts.
The operational impact of this vulnerability extends beyond simple privilege escalation as it enables attackers to bypass normal security boundaries within PostgreSQL installations. Database administrators who have granted EXECUTE permissions on amcheck functions to users or applications inadvertently create potential attack vectors that could allow lateral movement within the database environment. The affected versions span multiple major PostgreSQL releases, indicating a widespread impact that affects organizations running these specific version ranges across various deployment scenarios.
Organizations should immediately implement mitigations including restricting EXECUTE privileges on the amcheck function to only trusted database users and administrators. A comprehensive approach involves auditing existing permissions and ensuring that only essential personnel maintain the ability to execute amcheck functions. Additionally, database administrators should consider upgrading to PostgreSQL versions 18.5, 16.15, 15.19, or 14.24 where the vulnerability has been patched. The ATT&CK framework categorizes this as a privilege escalation technique under T1068, which specifically addresses local privilege escalation through insecure program execution. Organizations should also monitor database activity for unusual amcheck function usage patterns and implement proper access controls to prevent unauthorized users from obtaining the necessary privileges to exploit this vulnerability.
The vulnerability demonstrates how seemingly routine database maintenance functions can become attack vectors when proper security boundaries are not maintained within application code. This type of flaw underscores the importance of secure coding practices in database systems, particularly around privilege handling and environment variable management. The fact that PostgreSQL 17 remains unaffected suggests that the developers implemented proper search path isolation measures in that release, providing a clear migration path for organizations seeking to address this vulnerability through version upgrades.