CVE-2026-14673

PostgreSQL amcheck does not clear untrusted search path

State: Published
Severity: 3.8 Low
Published: Aug 13, 2026
Updated: Aug 29, 2026
Reserved: Jul 3, 2026

Description

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

Scores

CVSS	Score	Vector	Source
3.1	3.8 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N	PostgreSQL

Weaknesses

CWE-426 Untrusted Search Path

Affected Products

Product	Versions
PostgreSQLn/a	18 to before 18.6Affected 16 to before 16.15Affected 15 to before 15.19Affected before 14.24Affected

References

https://www.postgresql.org/support/security/CVE-2026-14673/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.