CVE-2026-6470 in PostgreSQL
Summary
by MITRE • 08/13/2026
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical authorization bypass in PostgreSQL's data definition language implementation that allows unauthorized users to disrupt database operations through strategic type dependency creation. The flaw exists in the privilege checking mechanism for certain DDL commands, specifically affecting ALTER and DROP operations on types where an object creator can establish dependencies that persist beyond their initial creation rights. The vulnerability stems from inconsistent authorization checks within PostgreSQL's internal command processing, where some DDL operations properly validate user privileges while others fail to enforce proper access controls during type assignment and reference operations.
The technical implementation of this vulnerability exploits the database's dependency tracking system, where a malicious user can create objects that reference specific types and subsequently leverage these dependencies to prevent legitimate administrators from performing necessary ALTER or DROP operations. When a type is used as a range subtype or referenced within SQL expressions, the privilege validation mechanism fails to properly verify whether the current user has sufficient permissions to modify or remove that type. This creates a scenario where an unauthorized actor can effectively lock out legitimate users from managing database objects they should have full control over.
The operational impact of this vulnerability extends beyond simple privilege escalation to include significant denial of service conditions that can severely disrupt database operations and administrative tasks. Database administrators may find themselves unable to perform routine maintenance, schema modifications, or cleanup operations on types that have been deliberately or inadvertently referenced by unauthorized users. The vulnerability affects multiple PostgreSQL release lines including versions 14 through 18, with specific patches available for each affected major version, indicating the widespread nature of this authorization flaw across the PostgreSQL ecosystem.
This issue aligns with CWE-285 which addresses improper authorization in database management systems and corresponds to ATT&CK technique T1078 which covers valid accounts and privilege escalation. The vulnerability demonstrates how insufficient input validation and authorization checking can create persistent security weaknesses that allow attackers to maintain control over system resources. Organizations should prioritize applying the relevant patches for their PostgreSQL installations as soon as possible, while also implementing monitoring for unusual type dependency patterns and unauthorized object creation activities.
The root cause analysis reveals that PostgreSQL's privilege checking system was not consistently applied across all code paths involving type references in DDL operations, creating an authorization gap specifically around range subtypes and SQL expression dependencies. This gap allows users to establish persistent dependencies that cannot be easily removed without proper administrative privileges, effectively creating a denial of service condition. The vulnerability serves as a reminder of the complexity involved in maintaining proper authorization controls in database systems where objects can have complex interdependencies that span multiple operations and user contexts.
Security teams should implement comprehensive monitoring for type dependency creation patterns and establish clear procedures for identifying and resolving unauthorized object dependencies. Database administrators should review existing type dependencies and ensure proper access controls are in place to prevent unauthorized users from creating persistent references that could lead to operational disruptions. The patching strategy should include thorough testing of existing database operations to ensure that the fix does not introduce compatibility issues while effectively addressing the authorization bypass condition.