CVE-2026-14673
Received Received - Intake

Untrusted search path in PostgreSQL amcheck

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14673
EUVD
EUVD-2026-57839

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5 (exc)
postgresql postgresql to 16.15 (exc)
postgresql postgresql to 15.19 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PostgreSQL's amcheck extension involves an untrusted search path that isn't properly cleared. A user with EXECUTE privilege on the amcheck function can set a malicious search path before calling the function. This allows them to execute arbitrary functions as the owner of expression indexes that depend on the search path.

Detection Guidance

To detect this vulnerability, check PostgreSQL versions using 'psql --version' or 'SELECT version();'. Affected versions are 18.x < 18.5, 16.x < 16.15, 15.x < 15.19, and 14.x < 14.24. Verify if the amcheck extension is installed with 'SELECT * FROM pg_extension WHERE extname = 'amcheck';'.

Impact Analysis

If exploited, this vulnerability could allow an attacker with limited privileges to gain higher-level access by executing functions as the owner of affected indexes. This could lead to unauthorized data access, modification, or other malicious actions within the database.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate compliance requirements for GDPR, HIPAA, or other regulations. Organizations using affected PostgreSQL versions must apply patches to maintain compliance and protect sensitive data.

Mitigation Strategies

Upgrade PostgreSQL to the latest patched versions (18.5, 16.15, 15.19, or 14.24). Revoke EXECUTE privilege on amcheck from untrusted users with 'REVOKE EXECUTE ON FUNCTION amcheck(amcheck_options) FROM PUBLIC;' or specific users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart