CVE-2026-14673 PostgreSQL CVE debrief

Who should care

PostgreSQL database administrators and users with EXECUTE privilege on the amcheck function should be aware of this vulnerability and take necessary actions to secure their databases. This includes restricting EXECUTE privilege on the amcheck function to trusted users, monitoring and auditing PostgreSQL database activity for suspicious function execution, and applying patches for PostgreSQL versions 18.6, 16.15, 15.19, and 14.24 or later. Additionally, security teams and vulnerability management teams should review the vulnerability's impact on their organization's PostgreSQL deployments and prioritize patching vulnerable versions to prevent potential arbitrary function execution.

Technical summary

The vulnerability exists in the amcheck function of PostgreSQL, allowing users with EXECUTE privilege on the function to execute arbitrary functions as the owners of expression indexes by manipulating the search path. This issue affects multiple PostgreSQL versions, including 14.0 to 14.24, 15.0 to 15.19, 16.0 to 16.15, and 18.0 to 18.5. The vulnerability can be exploited by setting a hostile search path before calling the amcheck function. To mitigate this vulnerability, it is essential to restrict EXECUTE privilege on the amcheck function to trusted users and monitor PostgreSQL database activity for suspicious function execution.

Defensive priority

PostgreSQL users should prioritize patching vulnerable versions to prevent potential arbitrary function execution.

Recommended defensive actions

• Apply patches for PostgreSQL versions 18.6, 16.15, 15.19, and 14.24 or later.
• Restrict EXECUTE privilege on the amcheck function to trusted users.
• Monitor and audit PostgreSQL database activity for suspicious function execution.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE is based on an untrusted search path vulnerability in PostgreSQL amcheck. A grantee of the amcheck function EXECUTE privilege can execute arbitrary functions as the owners of expression indexes that depend on the search path by setting a hostile search path before calling the amcheck function. This affects PostgreSQL major versions 18, 16, 15, and 14, with minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 being vulnerable.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.