CVE-2026-14673

An untrusted search path vulnerability in PostgreSQL's amcheck module allows a user with EXECUTE privileges to escalate privileges or execute arbitrary code. By setting a malicious search path before invoking an amcheck function, an attacker can hijack execution to run arbitrary SQL functions with the elevated permissions of the expression index owner.

This vulnerability is rated as Low impact because exploitation requires an attacker to already possess EXECUTE privileges on amcheck functions. The necessity of having this pre-existing, elevated database access to manipulate the search path significantly limits the likelihood of successful privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not GRANT EXECUTE on amcheck functions (bt_index_check, bt_index_parent_check, verify_heapam, and related) to non-superuser roles. If index verification is unused, drop the extension (DROP EXTENSION amcheck). Restrict PostgreSQL to trusted clients.