{"id":"CVE-2026-14673","year":2026,"sequence":14673,"component":"contrib module","score":3.8,"cvss_version":"3.0","vector":"AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","first_published":"2026-08-13","source_url":"https://www.postgresql.org/support/security/CVE-2026-14673/","facts":{"affected":{"14":"14","15":"15","16":"16","18":"18"},"affected_ranges":[{"from":"0","until":"14.24"},{"from":"15","until":"15.19"},{"from":"16","until":"16.15"},{"from":"18","until":"18.6"}],"cna_url":"https://cveawg.mitre.org/api/cve/CVE-2026-14673","component":"contrib module","cvss_version":"3.0","description_en":"Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.","first_published":"2026-08-13","fixed":{"14":"14.24","15":"15.19","16":"16.15","18":"18.6"},"id":"CVE-2026-14673","introduced":{},"published":{"14":"2026-08-13","15":"2026-08-13","16":"2026-08-13","18":"2026-08-13"},"score":3.8,"title":"PostgreSQL amcheck does not clear untrusted search path","url":"https://www.postgresql.org/support/security/CVE-2026-14673/","vector":"AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},"reviewed_hash":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_hash":"965b9e2323feab543f3cbeb74c418c3a5b43cbefc6594d2862ff0d24dcf8e6a2","text":{"locale":"zh-Hans","title":"PostgreSQL amcheck 未清除不可信的 search_path","description":"PostgreSQL amcheck 未清除不可信的 search_path","details":"PostgreSQL amcheck 使用了不可信的搜索路径。拥有 amcheck 函数 EXECUTE 权限的用户，可在调用函数前设置 恶意 search_path，以依赖搜索路径的表达式索引所有者身份执行任意函数。在主版本 18、16、15 和 14 中， PostgreSQL 18.6、16.15、15.19 和 14.24 之前的小版本受此问题影响；PostgreSQL 17 不受影响。","format":"markdown","provenance":{"identity":"immutable_cve_code","sources":[{"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"component":"contrib module","cve":"2026-14673","cvenumber":202614673,"description":"PostgreSQL amcheck 未清除不可信的 search_path","details":"PostgreSQL amcheck 使用了不可信的搜索路径。拥有 amcheck 函数 EXECUTE 权限的用户，可在调用函数前设置 恶意 search_path，以依赖搜索路径的表达式索引所有者身份执行任意函数。在主版本 18、16、15 和 14 中， PostgreSQL 18.6、16.15、15.19 和 14.24 之前的小版本受此问题影响；PostgreSQL 17 不受影响。","detailslink":"","id":97,"legacyscore":"","newspost_id":3365,"public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},"source":"center","source_id":97,"source_table_sha256":"b57ee28b2263464208af0ccf7512b31f0c1ab7140d12dda09a0c87de341f1372"},{"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"component":"contrib module","cve":"2026-14673","cvenumber":202614673,"description":"PostgreSQL amcheck 未清除不可信的 search_path","details":"PostgreSQL amcheck 使用了不可信的搜索路径。拥有 amcheck 函数 EXECUTE 权限的用户，可在调用函数前设置 恶意 search_path，以依赖搜索路径的表达式索引所有者身份执行任意函数。在主版本 18、16、15 和 14 中， PostgreSQL 18.6、16.15、15.19 和 14.24 之前的小版本受此问题影响；PostgreSQL 17 不受影响。","detailslink":"","id":97,"legacyscore":"","newspost_id":3365,"public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"},"source":"pgweb","source_id":97,"source_table_sha256":"b57ee28b2263464208af0ccf7512b31f0c1ab7140d12dda09a0c87de341f1372"}]},"text_hash":"0d9145504b47343b1a3e645231ffd467d4f07cb0e723f4f8dc89a5dc43e2ecde"},"locales":["en","zh-Hans"],"fixes":[{"major":"14","fixed_version":"14.24","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"14.24","introduced":null,"published":"2026-08-13"}},{"major":"15","fixed_version":"15.19","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"15.19","introduced":null,"published":"2026-08-13"}},{"major":"16","fixed_version":"16.15","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"16.15","introduced":null,"published":"2026-08-13"}},{"major":"18","fixed_version":"18.6","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"18.6","introduced":null,"published":"2026-08-13"}}],"legacy":[{"source":"center","source_id":97,"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"id":97,"cve":"2026-14673","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","details":"PostgreSQL amcheck 使用了不可信的搜索路径。拥有 amcheck 函数 EXECUTE 权限的用户，可在调用函数前设置 恶意 search_path，以依赖搜索路径的表达式索引所有者身份执行任意函数。在主版本 18、16、15 和 14 中， PostgreSQL 18.6、16.15、15.19 和 14.24 之前的小版本受此问题影响；PostgreSQL 17 不受影响。","component":"contrib module","cvenumber":202614673,"description":"PostgreSQL amcheck 未清除不可信的 search_path","detailslink":"","legacyscore":"","newspost_id":3365},"fixes":[{"source_id":400,"source_version_id":31,"major":"18","fixed_minor":6,"raw":{"id":400,"patch_id":97,"version_id":31,"fixed_minor":6},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":6,"firstreldate":"2025-09-25"}},{"source_id":401,"source_version_id":29,"major":"16","fixed_minor":15,"raw":{"id":401,"patch_id":97,"version_id":29,"fixed_minor":15},"version_raw":{"id":29,"tree":16.0,"current":false,"docsgit":"","eoldate":"2028-11-09","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":15,"firstreldate":"2023-09-14"}},{"source_id":402,"source_version_id":28,"major":"15","fixed_minor":19,"raw":{"id":402,"patch_id":97,"version_id":28,"fixed_minor":19},"version_raw":{"id":28,"tree":15.0,"current":false,"docsgit":"","eoldate":"2027-11-11","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":19,"firstreldate":"2022-10-13"}},{"source_id":403,"source_version_id":27,"major":"14","fixed_minor":24,"raw":{"id":403,"patch_id":97,"version_id":27,"fixed_minor":24},"version_raw":{"id":27,"tree":14.0,"current":false,"docsgit":"","eoldate":"2026-11-12","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":24,"firstreldate":"2021-09-30"}}]},{"source":"pgweb","source_id":97,"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"id":97,"cve":"2026-14673","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","details":"PostgreSQL amcheck 使用了不可信的搜索路径。拥有 amcheck 函数 EXECUTE 权限的用户，可在调用函数前设置 恶意 search_path，以依赖搜索路径的表达式索引所有者身份执行任意函数。在主版本 18、16、15 和 14 中， PostgreSQL 18.6、16.15、15.19 和 14.24 之前的小版本受此问题影响；PostgreSQL 17 不受影响。","component":"contrib module","cvenumber":202614673,"description":"PostgreSQL amcheck 未清除不可信的 search_path","detailslink":"","legacyscore":"","newspost_id":3365},"fixes":[{"source_id":400,"source_version_id":31,"major":"18","fixed_minor":6,"raw":{"id":400,"patch_id":97,"version_id":31,"fixed_minor":6},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":6,"firstreldate":"2025-09-25"}},{"source_id":401,"source_version_id":29,"major":"16","fixed_minor":15,"raw":{"id":401,"patch_id":97,"version_id":29,"fixed_minor":15},"version_raw":{"id":29,"tree":16.0,"current":false,"docsgit":"","eoldate":"2028-11-09","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":15,"firstreldate":"2023-09-14"}},{"source_id":402,"source_version_id":28,"major":"15","fixed_minor":19,"raw":{"id":402,"patch_id":97,"version_id":28,"fixed_minor":19},"version_raw":{"id":28,"tree":15.0,"current":false,"docsgit":"","eoldate":"2027-11-11","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":19,"firstreldate":"2022-10-13"}},{"source_id":403,"source_version_id":27,"major":"14","fixed_minor":24,"raw":{"id":403,"patch_id":97,"version_id":27,"fixed_minor":24},"version_raw":{"id":27,"tree":14.0,"current":false,"docsgit":"","eoldate":"2026-11-12","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":24,"firstreldate":"2021-09-30"}}]}]}