L3 · ShartedPostgreSQL · Database · Security updatepostgresql-november-security

PostgreSQL fixes 52 vulnerabilities across server, replication and backup tools

PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 vulnerabilities. Some let database object creators, a compromised replication publisher or a crafted backup archive reach OS code execution. PostgreSQL 14.25 is the final upstream release for 14.

Disclosed: Nov 12, 2026; Public disclosure date
Severity: CVSS 8.8 × 4; 5 CVEs tracked here
Splash zone: Older PostgreSQL 14–18 servers and client tools. Exposure depends on database privileges, replication setup or the backup being restored.; PostgreSQL · Database · Security update
In the wild: Unknown; The upstream release and advisories reviewed do not report confirmed exploitation.

What happened

The November 12 PostgreSQL batch addresses database privilege boundaries, memory safety, replication and administrative utilities. The project publishes the complete list of 52 CVEs, with a separate affected-version table for each advisory.

The server-side paths differ. CVE-2026-120143 needs an object creator. CVE-2026-120145 needs a compromised publisher and a subscription owned by a superuser. CVE-2026-116322 is reachable before login and can restart a vulnerable PostgreSQL 18 server.

Upgrade the client tools wherever they run. CVE-2026-116314 affects the host that runs pg_restore on a crafted non-plain archive. CVE-2026-116330 affects the host running psql on the restore script inside a tar dump from a compromised server. A minor server upgrade can be done in place without pg_upgrade or a dump and reload. The release’s backup and index instructions still apply.

L3 reflects the breadth of the affected PostgreSQL installations and the potential for OS code execution under the stated prerequisites. The reviewed upstream material does not identify compromised deployments or report in-the-wild exploitation.

What’s in the bowl

CVE-2026-120143CVSS 8.8

Trigger cursor use after free

A database object creator can use a cursor over a trigger transition table to run code as the database server's OS user.

CVE-2026-120145CVSS 8.8

Logical replication authorization gap

A compromised publisher can target subscriber system catalogs to run code as the subscriber server's OS user when the subscription is owned by a database superuser.

CVE-2026-116314CVSS 8.8

Code execution during archive restore

Running a vulnerable pg_restore on a crafted non-plain archive can execute code under the OS account running the restore.

CVE-2026-116330CVSS 8.8

psql command injection via tar restore script

A compromised source server can influence a tar dump so that running its restore.sql with psql executes code as the client OS user.

CVE-2026-116322CVSS 5.3

Pre-authentication PostgreSQL 18 restart

A network client can cause a server restart by timing a cancellation request to race with the authentication timeout. This flaw affects major version 18 only.

Fixed versions

Product	Safe from	Note
PostgreSQL 18	`18.7`
PostgreSQL 17	`17.12`
PostgreSQL 16	`16.16`
PostgreSQL 15	`15.20`
PostgreSQL 14	`14.25`	Final upstream release

Crime-scene timeline

Nov 12, 2026
PostgreSQL publishes the fixes and ends upstream support for version 14
The project ships updates for stable branches 14–18 and includes applicable fixes in PostgreSQL 19 RC 2.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

PostgreSQL release announcementPrimaryLists all 52 issues, release versions, end of support for 14 and post-update tasks.
PostgreSQL 18.7 release notesPrimaryDescribes branch-specific changes and additional maintenance steps.

Wipe guide

The wipe checklist

0 of 4 sheets used

Patch running servers and every copy of the affected client toolsRun SHOW server_version on each primary and standby, and check pg_dump, pg_restore and psql versions in backup images and automation. For a minor update, stop the server, install the fixed binaries for its branch, restart and verify the running version. Managed deployments should check the provider’s rollout and version on each instance.
Review SQL privileges, logical replication and restore inputsPrioritize servers where untrusted roles can create objects and subscribers that use superuser-owned subscriptions. Inspect subscription ownership and publisher trust. Restrict database network access and avoid restoring untrusted archives. Treat a suspected execution path as an incident on the corresponding server or restore host.
Refresh backups and apply the release’s maintenance stepsIf you use incremental backups, take a fresh full backup after the update, use it as the next baseline and verify a restore. Use REINDEX INDEX on suspect GIN indexes, GiST indexes using gist_trgm_ops and B-tree indexes on bpchar without a length. Run REINDEX TABLE when reads report missing chunk number. Use the release announcement’s query to find NOT NULL NO INHERIT constraints on partitioned tables. Drop unwanted constraints or repair them with INHERIT after checking partitions for NULL values. Review any skipped releases for additional steps.
Schedule the PostgreSQL 14 major upgradeApply 14.25 to existing 14 instances and plan a supported-major migration. Test the upgrade and rollback using a verified backup and the target version’s upgrade guide.