CVE-2026-119922
Received
Received - Intake
Improper Access Control in Babelfish for PostgreSQL Extension
Vulnerability report for CVE-2026-119922, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-03
Last updated on: 2026-11-03
Assigner: AMZN
Description
Description
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| AWS | babelfish-for-postgresql | 1.2 |
| AWS | babelfish-for-postgresql | 2.1 |
| AWS | babelfish-for-postgresql | 3.1 |
| AWS | babelfish-for-postgresql | 4.0 |
| AWS | babelfish-for-postgresql | 5.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
