Babelfish for PostgreSQL EUVD-2026-116115

Requires an existing authenticated, remotely-reachable low-privileged login to a Babelfish for PostgreSQL instance running an affected version (1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, or 5.1-5.4); exploitation does not require user interaction or elevated privileges beyond that initial authenticated access (PR:L, UI:N, AC:L). No special non-default configuration is named in the vendor advisory, and the specific feature or operation that is improperly access-controlled is not described in the available sources. Exploitation is limited by the authentication requirement (the attacker must already have a valid DB login) and by the affected-version range; instances upgraded to 4.10, 5.6, or 6.1 are not vulnerable. The vendor states there is no workaround, so unpatched affected versions remain exposed to any authenticated principal.

This is a credible, actionable priority rather than a paper-high-CVSS issue, but the signals are moderate rather than emergency-grade. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) scores 8.7 and describes a network-reachable, low-complexity privilege escalation requiring only low existing privileges (PR:L) and no user interaction, with full confidentiality, integrity and availability impact on the vulnerable system (scope/subsequent system N). The vuln.today decision label is 'this_week', which aligns with a serious-but-not-actively-exploited posture. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference are present in the input, so there is no evidence of active exploitation or public exploit code - exploitation status is therefore 'no public exploit identified at time of analysis'. The key limiting factor is PR:L: an attacker must already hold a valid authenticated Babelfish/SQL Server login, making this a post-authentication escalation (e.g., a low-privileged tenant or application login escalating to higher DB privileges) rather than an unauthenticated internet attack. The vulnerability is confirmed and fixed by the vendor (AWS) via a GHSA advisory and AWS security bulletin, which raises confidence in the finding itself even though exploitation telemetry is absent.

A remote user who already holds a low-privileged authenticated login to a Babelfish-enabled PostgreSQL instance abuses improper access control (CWE-266) to elevate to higher database privileges, gaining read/write and potentially administrative control over data and objects. The specific trigger mechanism is not described in the available sources. No public proof-of-concept or exploit code is referenced in the input.