# CVE-2026-6460: PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code

Status: published. Published: 2026-11-12. Updated: 2026-11-12.

Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.  Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN".  The system had inadequate tracking of typed values, and values were not self-identifying.  Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system.  PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- n/a / PostgreSQL: ≥ 18; < 18.7 (affected, rpm); ≥ 17; < 17.12 (affected, rpm); ≥ 16; < 16.16 (affected, rpm); ≥ 15; < 15.20 (affected, rpm); ≥ 0; < 14.25 (affected, rpm). Source: CNA: PostgreSQL

## Severity and prioritization

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: PostgreSQL

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-843

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.postgresql.org/support/security/CVE-2026-6460/ (CNA: PostgreSQL)

## Provenance

- CNA: PostgreSQL: https://www.cve.org/CVERecord?id=CVE-2026-6460; retrieved 2026-11-12; source updated 2026-11-12

Revision: 50834f17472b1d26615b307e102839a463acf8671bc1f79c7062de3488095a97

Canonical: https://y2.dev/cve/CVE-2026-6460

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.