EUVD-2026-57839
GHSA-qp83-ppf3-v924
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
PR:H reflects the mandatory explicit EXECUTE grant on amcheck; impact capped at L/L/N as escalation stays within the database trust boundary.
Primary rating from Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007).
CVSS VectorVendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Lifecycle Timeline
3DescriptionCVE.org
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.
AnalysisAI
Untrusted search path in PostgreSQL's amcheck extension allows a database user holding EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes by injecting a hostile search_path before calling amcheck. Affected are PostgreSQL major versions 14, 15, 16, and 18 in releases prior to 14.24, 15.19, 16.15, and 18.5 respectively; version 17 is entirely unaffected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the niche exploitation prerequisite of an explicitly granted amcheck EXECUTE privilege.
Technical ContextAI
PostgreSQL's amcheck module (Access Method Check) provides SQL-callable functions - such as bt_index_check and heap_page_items - for verifying the structural and logical integrity of B-tree indexes and heap tables. The root cause is CWE-426 (Untrusted Search Path): amcheck functions resolve function references at execution time using the session's active search_path. Expression indexes (e.g., CREATE INDEX ON t(lower(name))) embed function calls whose resolution is path-dependent and whose execution context is the index owner's privilege level. Because PostgreSQL allows any session-level SET search_path, a grantee of amcheck EXECUTE can substitute a hostile schema entry that shadows the legitimate function, causing amcheck to execute attacker-supplied code under the index owner's identity. The flaw is absent in PostgreSQL 17, suggesting it was addressed during that major-version development cycle but not backported until the targeted minor releases.
RemediationAI
Upgrade to PostgreSQL 18.5, 16.15, 15.19, or 14.24 depending on the major version branch in use; these are the fixed releases confirmed by the vendor advisory at https://www.postgresql.org/support/security/CVE-2026-14673/. Until patching is feasible, the most effective compensating control is to revoke all non-essential EXECUTE privileges on amcheck functions (bt_index_check, bt_index_parent_check, heap_page_items, etc.) from any role that does not strictly require index verification capabilities - this eliminates the exploitation prerequisite entirely with no functional impact on normal workloads. If amcheck access cannot be revoked, restrict the ability of grantee roles to alter session-level search_path by enforcing a fixed path at role creation time via ALTER ROLE <role> SET search_path = pg_catalog, public, which significantly reduces the attack surface, though with the trade-off that any application relying on dynamic schema resolution for that role may be affected.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today