CVE-2026-6469
Received Received - Intake

Incorrect Ownership Assignment in PostgreSQL ALTER TABLE ALTER TYPE

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-6469
EUVD
EUVD-2026-57855

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 18.5|end_excluding=17.11|end_excluding=16.15|end_excluding=15.19|end_excluding=14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-708 The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an incorrect ownership assignment in PostgreSQL's ALTER TABLE ALTER TYPE command. It causes dependent statistics objects to be reassigned to the current user, allowing the table owner to improperly execute DROP STATISTICS and ALTER STATISTICS commands. The original owner of the statistics objects is then denied these commands.

Detection Guidance

To detect this vulnerability, check PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, or 14.24 using the command: psql --version. If affected, review ALTER TABLE ALTER TYPE commands in logs for improper ownership changes. Look for unauthorized DROP STATISTICS or ALTER STATISTICS commands executed by non-owners.

Impact Analysis

The impact is limited because DROP TABLE can still remove statistics objects, reducing the exploit's effectiveness in many ownership setups. However, it may allow unauthorized changes to statistics objects, potentially affecting data integrity and availability.

Mitigation Strategies

Immediately update PostgreSQL to versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later. Revoke unnecessary privileges from users who should not modify statistics objects. Monitor for suspicious DROP STATISTICS or ALTER STATISTICS commands in database logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6469. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart