Originally published on proxymint.

PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 CVEs, including CVE-2026-6460 (CVSS 8.8). Check your version, your logins, and plan off 14.

TL;DR

  • Run SELECT version(); on every Postgres you own, including the one your scrapers write to. If the minor number is below 18.7, 17.12, 16.16, 15.20 or 14.25, that server is missing 52 security fixes released on 12 November 2026.
  • CVE-2026-6460 is the one to read first. It's a type confusion rated 8.8 that lets a role able to create objects run code as the operating system user behind the database, and the researcher says a lowest-privileged login role can trigger it.
  • Shared logins are the real exposure. If scraper workers, tenants or a BI tool connect with their own roles, each of those roles is someone who could reach the bug.
  • PostgreSQL 14 is end of life with 14.25. Patch to 14.25 now, because it's the last fix 14 will ever get, then plan the major upgrade.

Key takeaways

  • This is a minor update for 15 to 18. PostgreSQL says you can stop the server and swap binaries, with no dump and reload, though a few index types want a REINDEX afterwards.
  • Update the client tools too. pg_dump, pg_restore, reindexdb, vacuumdb and pg_basebackup all have fixes in this release, which matters most on the box you'll use to migrate off 14.
  • Managed Postgres is not exempt. Mehmet Ince says every managed vendor he tested was affected, so check which minor version your provider runs and when it moves.
  • 32 of the 52 CVEs carry the same 8.8 score, so patching only CVE-2026-6460 isn't a plan. Take the whole release.

Read the full guide on proxymint, with the commands, tables and sources.