CVE-2026-14680

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments.

This is an Important vulnerability where any authenticated PostgreSQL user can achieve arbitrary code execution as the operating system user running the database. This type confusion flaw bypasses intended security boundaries for 'internal' data types, leading to a significant privilege escalation and potential compromise of the entire database server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict PostgreSQL to trusted hosts and bind only the required interfaces; use pg_hba.conf so only trusted clients can reach the port. Do not grant CONNECT (or any SQL login) to untrusted roles —any session can trigger this.