CVE WatchNov 12, 2026

CVE-2026-116316

Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the

CVSS

8.8

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 12, 2026 · Last modified: Nov 12, 2026 · CWE-424

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Official references

www.postgresql.orghttps://www.postgresql.org/support/security/CVE-2026-116316/

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-162375.4 MED

—

———Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.4h CVE-2026-1201544.3 MED

—

———Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.4h CVE-2026-142426.5 MED

—

——0A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).1d CVE-2026-1137575.5 MED

41.1%

——12Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.1d CVE-2026-1137565.3 MED

57.8%

——17Improper access control in Windows FileCrypt Driver allows an authorized attacker to bypass a security feature over a network.1d CVE-2026-112917—

8.1%

——2In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.6d