CVE-2026-2004: 
PostgreSQL vulnerability analysis and mitigation

CVE-2026-2004 is a vulnerability in the PostgreSQL intarray extension's selectivity estimator function caused by missing validation of the type of input, allowing an authenticated object creator to execute arbitrary code as the operating system user running the database. It affects PostgreSQL versions 14.x before 14.21, 15.x before 15.16, 16.x before 16.12, 17.x before 17.8, and 18.x before 18.2. The vulnerability was published on February 12, 2026, and patches were released simultaneously with disclosure. It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Bugzilla, PostgreSQL Advisory).

The root cause is classified as CWE-1287 (Improper Validation of Specified Type of Input). The intarray extension's selectivity estimator function fails to validate that the type of input it receives is appropriate before processing it, enabling an attacker who can create database objects to supply a maliciously typed argument that triggers arbitrary code execution at the OS level. Exploitation requires the attacker to have object creation privileges within the database (e.g., the ability to create operators or functions), making this a network-accessible, low-privilege, no-user-interaction attack. A fix commit is available in the PostgreSQL git repository (PostgreSQL Git, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker with object creation privileges to execute arbitrary code with the privileges of the OS user running the PostgreSQL database process (typically postgres). This can result in complete compromise of the database server, including unauthorized access to all data stored in the database, modification or destruction of database contents, and potential lateral movement to other systems accessible from the database host (Red Hat Bugzilla, PostgreSQL Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.106%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (object creation rights in the database) and no user interaction, which lowers the barrier for authenticated attackers.

1. Reconnaissance: Identify PostgreSQL instances running a vulnerable version (before 14.21, 15.16, 16.12, 17.8, or 18.2) with the intarray extension enabled, accessible over the network.
2. Obtain database access: Authenticate to the PostgreSQL database with a low-privilege account that has object creation privileges (e.g., CREATE privilege on a schema).
3. Craft malicious object: Create a database object (such as an operator or function) that passes an improperly typed argument to the intarray extension's selectivity estimator function, bypassing the missing type validation.
4. Trigger code execution: Cause the database to invoke the selectivity estimator (e.g., by executing a query that uses the crafted operator against an intarray-indexed column), which processes the malicious input and executes attacker-controlled code as the OS user running PostgreSQL.
5. Achieve OS-level access: Use the resulting code execution to establish persistence, exfiltrate data, or pivot to other systems accessible from the database host (Red Hat Bugzilla, PostgreSQL Advisory).

• Logs: Unexpected PostgreSQL error messages or crashes originating from the intarray selectivity estimator function; unusual CREATE OPERATOR or CREATE FUNCTION statements in PostgreSQL logs from low-privilege users.
• Process: Unusual child processes spawned by the PostgreSQL backend process (e.g., shells, network utilities like curl, wget, or nc) running as the postgres OS user.
• File System: Unexpected new files or scripts created in directories writable by the postgres OS user; new cron jobs or scheduled tasks owned by the postgres user.
• Network: Unexpected outbound network connections from the PostgreSQL server process to external IP addresses, particularly on non-standard ports.

Upgrade PostgreSQL to a patched version: 14.21, 15.16, 16.12, 17.8, or 18.2 depending on the currently deployed branch (PostgreSQL Advisory, PostgreSQL Release News). As a workaround while patching, restrict object creation privileges to trusted users only and consider temporarily dropping or disabling the intarray extension if it is not actively required. Red Hat has issued multiple errata (RHSA-2026:3730, RHSA-2026:3887, RHSA-2026:3896, and others) for RHEL 8, 9, and 10 (Red Hat Bugzilla). Ubuntu (USN-8072-1), SUSE, Debian, and other Linux distributions have also released updated packages.

The PostgreSQL Global Development Group released patched versions simultaneously with the CVE disclosure on February 12, 2026, and published a security advisory (PostgreSQL Advisory). Red Hat issued numerous errata across RHEL 8, 9, and 10 variants within weeks of disclosure, reflecting the broad impact on enterprise Linux distributions (Red Hat Bugzilla). A Reddit thread noted that PRTG monitoring software was also affected by this CVE, indicating downstream impact on third-party products embedding PostgreSQL. IBM addressed the vulnerability in API Connect, Business Automation Insights, and Instana Observability products (IBM Advisory).