{"affected":[{"defaultStatus":"unaffected","product":"PostgreSQL","source":"CNA: PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"cveId":"CVE-2026-116316","cwes":["CWE-424"],"description":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp.  The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: PostgreSQL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794492909406,"publishedAt":1794492909406,"references":[{"source":"CNA: PostgreSQL","tags":[],"url":"https://www.postgresql.org/support/security/CVE-2026-116316/"}],"remediation":[],"revision":"0514f151518f32d7109aa59376746bcd06a1bbf14f49ba0d3dd7baaa7ae8b3cf","sources":[{"modifiedAt":1794492909406,"name":"CNA: PostgreSQL","retrievedAt":1794496136963,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116316"}],"ssvc":null,"status":"published","title":"PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find","updatedAt":1794496136963}