PostgreSQL Command Vulnerability Allows Unauthorized Ownership Reassignment
CVE-2026-6469

3.8LOW

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-6469?

A vulnerability in PostgreSQL allows for incorrect ownership assignment in the ALTER TABLE ALTER TYPE command. This flaw permits a table owner to inadvertently gain control over dependent statistics objects, enabling actions such as DROP STATISTICS and ALTER STATISTICS that should be restricted. Previously designated owners of the statistics objects are improperly denied these commands. While the DROP TABLE command can still remove statistics objects, this exploit can pose risks in specific ownership scenarios. Affected versions include PostgreSQL 18.4 and earlier, 17.10 and earlier, 16.14 and earlier, 15.18 and earlier, and 14.23 and earlier. For further information, refer to the official PostgreSQL security page.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-6469/

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Noah Misch for reporting this problem.
.