CVE-2026-6472

score

<0.1

cvss

5.4

epss

0.2%

published

2026-05-14

kev added

—

first seen

2026-10-21

PostgreSQL < 18.4, 17.10, 16.14, 15.18, and 14.23 contains a broken access control caused by missing authorization in CREATE TYPE, letting object creators hijack queries using search_path to execute arbitrary SQL functions, exploit requires attacker to create objects.