CVE-2026-2004

score

<0.1

cvss

8.8

epss

1.3%

published

2026-02-12

kev added

—

first seen

2026-10-21

PostgreSQL intarray extension < 18.2, 17.8, 16.12, 15.16, and 14.21 contains a command injection caused by missing input type validation in selectivity estimator function, letting object creators execute arbitrary OS commands, exploit requires object creation privileges.