CVE-2026-6460: PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code
Vendor not yet named
No distribution fix yet for Debian 12/13 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
DescriptionNVD
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Fix status by distribution
From each distribution’s security tracker. Distributions we did not check are not listed.
- Debian 13Affected, no fix releasedchecked 13 Nov 03:30 UTC
- Debian 12Affected, no fix releasedchecked 13 Nov 03:30 UTC
What changed
Debian status tracked since 13 Nov 2026.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 13 Nov.
- PostgreSQL fixes 52 flaws, including code execution bugsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.