{"api_version":"1","generated_at":"2026-11-12T23:55:26+00:00","cve":"CVE-2026-116336","urls":{"html":"https://cve.report/CVE-2026-116336","api":"https://cve.report/api/cve/CVE-2026-116336.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-116336","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-116336"},"summary":{"title":"PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions","description":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","state":"PUBLISHED","assigner":"PostgreSQL","published_at":"2026-11-12 15:17:42","updated_at":"2026-11-12 22:18:28"},"problem_types":["CWE-672","CWE-843","CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')","CWE-672 Operation on a Resource after Expiration or Release"],"metrics":[{"version":"3.1","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-116336/","name":"https://www.postgresql.org/support/security/CVE-2026-116336/","refsource":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116336","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116336","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 18 18.7 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 17 17.12 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 16 16.16 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 15 15.20 rpm","platforms":[]},{"source":"CNA","vendor":"n/a","product":"PostgreSQL","version":"affected 14.25 rpm","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"The PostgreSQL project thanks Florent Saudel for reporting this problem.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-116336","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:18:26.834780Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-12T21:44:59.609Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"configurations":[{"lang":"en","value":"attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"}],"credits":[{"lang":"en","value":"The PostgreSQL project thanks Florent Saudel for reporting this problem."}],"descriptions":[{"lang":"en","value":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","description":"Access of Resource Using Incompatible Type ('Type Confusion')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-672","description":"Operation on a Resource after Expiration or Release","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T14:15:20.347Z","orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","shortName":"PostgreSQL"},"references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-116336/"}],"title":"PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions","x_postgresql":{"component":"core server"}}},"cveMetadata":{"assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","assignerShortName":"PostgreSQL","cveId":"CVE-2026-116336","datePublished":"2026-11-12T14:15:20.347Z","dateReserved":"2026-10-26T04:01:48.586Z","dateUpdated":"2026-11-12T21:44:59.609Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 15:17:42","lastModifiedDate":"2026-11-12 22:18:28","problem_types":["CWE-672","CWE-843","CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')","CWE-672 Operation on a Resource after Expiration or Release"],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-12T21:18:26.834780Z","id":"CVE-2026-116336","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"116336","Ordinal":"1","Title":"PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during","CVE":"CVE-2026-116336","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"116336","Ordinal":"1","NoteData":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","Type":"Description","Title":"PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during"}]}}}