Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ...
by firer on Thursday November 12, 2026 @02:13PM
(#50472612)
All of these seem to be post-auth, except for CVE-2026-116322 (which doesn't grant code execution, "only" a DoS).
About a year ago I found and exploited CVE-2026-2004, which is also a Postgres post-auth RCE, as part of Wiz's zeroday.cloud competition.
I choose that target because it immediately stood out as highly complex with lots of user input. In my opinion, it's a bad idea to define this as a security boundary in the first place. Access to a database can very likely lead to code execution - there's way too much attack surface.
Most serious cloud providers rightly sandbox their DB offerings exactly for this reason. And this year's zeroday.cloud competition no longer has authenticated Postgres as a target, exactly for this reason.
About a year ago I found and exploited CVE-2026-2004, which is also a Postgres post-auth RCE, as part of Wiz's zeroday.cloud competition.
I choose that target because it immediately stood out as highly complex with lots of user input. In my opinion, it's a bad idea to define this as a security boundary in the first place. Access to a database can very likely lead to code execution - there's way too much attack surface.
Most serious cloud providers rightly sandbox their DB offerings exactly for this reason. And this year's zeroday.cloud competition no longer has authenticated Postgres as a target, exactly for this reason.