PostgreSQL CVE-2026-6469

Exploitation requires the attacker to hold ownership of a PostgreSQL table (PR:H) that has dependent extended statistics objects (created via CREATE STATISTICS) owned by a different database role. The vulnerable code path is triggered specifically by ALTER TABLE ALTER TYPE - changing a column's data type. Without a divergent ownership relationship between the table and its statistics objects, there is no additional unauthorized capability gained beyond what the table owner already controls. Exploitation is further limited by the fact that DROP TABLE can already cascade-delete statistics objects, so this bug only provides a marginal escalation in environments with deliberate separation of table and statistics ownership.

The CVSS 3.1 base score of 3.8 (Low) is well-calibrated for this vulnerability. The vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L reflects that exploitation requires existing high-privilege database access (table ownership), no confidentiality is exposed, and the integrity and availability impacts are limited to statistics objects rather than user data. EPSS data is not supplied, but given the low severity, niche exploitation preconditions, and absence of any KEV or POC listing, real-world exploitation probability is low. The described self-limiting factor - that DROP TABLE already removes statistics regardless - further reduces meaningful attacker leverage. This is primarily a privilege-logic correctness issue rather than a data-breach risk. Security teams should prioritize this in scheduled patching cycles rather than emergency response.

A database user with ownership of a target table connects over the network and executes ALTER TABLE ALTER TYPE on a column, triggering the buggy ownership-reassignment code path. The attacker's user ID is now recorded as owner of any dependent extended statistics objects, even those originally created by a different role. The attacker can then issue DROP STATISTICS against those objects, forcing the query planner to lose multi-column correlation data and potentially degrade query performance. No public exploit code exists for this vulnerability.