Description
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Published: 2026-08-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Type confusion in PostgreSQL’s refint module allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this vulnerability was introduced in the source code with the commit message "refint: Remove plan cache.", but no CVE was assigned. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Systems

The vulnerability affects PostgreSQL releases prior to 18.6, 17.11, 16.15, 15.19, and 14.24. Users running any of these versions on a PostgreSQL server are at risk.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with object‑creation privileges within the database; once such a user introduces a malicious refint object, the code runs with the database process’s OS privileges.

Generated by OpenCVE AI on August 30, 2026 at 00:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade PostgreSQL to any supported version that includes the fix: 18.6 or later, 17.11 or later, 16.15 or later, 15.19 or later, or 14.24 or later.
  • If an upgrade cannot be performed immediately, disable or remove the refint extension from the database to prevent the bug from being triggered.
  • Limit CREATE privileges for refint objects to trusted roles only, reducing the attack surface for malicious object creation.

Generated by OpenCVE AI on August 30, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4740-1 postgresql-15 security update
Debian DSA Debian DSA DSA-6438-1 postgresql-17 security update
Ubuntu USN Ubuntu USN USN-8653-1 PostgreSQL vulnerabilities
History

Sat, 29 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Description Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Wed, 19 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Postgresql
Postgresql postgresql
Vendors & Products Postgresql
Postgresql postgresql

Thu, 13 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Description Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Title PostgreSQL refint plan cache type confusion executes arbitrary code
Weaknesses CWE-843
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Postgresql Postgresql
cve-icon MITRE

Status: PUBLISHED

Assigner: PostgreSQL

Published:

Updated: 2026-08-29T23:07:38.626Z

Reserved: 2026-07-03T20:28:13.192Z

Link: CVE-2026-14671

cve-icon Vulnrichment

Updated: 2026-08-13T15:39:54.423Z

cve-icon NVD

Status : Modified

Published: 2026-08-13T13:17:44.530

Modified: 2026-08-29T23:17:14.127

Link: CVE-2026-14671

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-30T00:30:06Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')