CVE-2026-6470
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A missing authorization flaw in PostgreSQL DDL commands allows an object creator to cause denial of service against ALTER and DROP of a type by creating a dependency on it. Many DDL operations checked privileges, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Risk Assessment
The risk includes potential disruption of database schema management, leading to unavailability of dependent services.
Recommendation
Upgrade PostgreSQL to the latest patched version and review user privileges for object creation.
Original NVD description (English source)
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.