PostgreSQL 14-18: Untrusted Search Path in amcheck leads to privilege escalation
CVE-2026-14673 Published on August 13, 2026
PostgreSQL amcheck does not clear untrusted search path
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.
Weakness Type
What is an Untrusted Path Vulnerability?
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.
CVE-2026-14673 has been classified to as an Untrusted Path vulnerability or weakness.
Products Associated with CVE-2026-14673
Want to know whenever a new CVE is published for PostgreSQL? stack.watch will email you.
