CVE-2026-2004
📋 TL;DR
This vulnerability in PostgreSQL's intarray extension allows attackers to execute arbitrary code with the privileges of the database operating system user. It affects PostgreSQL installations with the intarray extension enabled, specifically versions before 18.2, 17.8, 16.12, 15.16, and 14.21.
💻 Affected Systems
- PostgreSQL
📦 What is this software?
Postgresql by Postgresql
Postgresql by Postgresql
Postgresql by Postgresql
Postgresql by Postgresql
Postgresql by Postgresql
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with database user privileges leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Database compromise allowing data exfiltration, privilege escalation, or denial of service attacks.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are enforced, though database integrity could still be compromised.
🎯 Exploit Status
Requires database access and CREATE privilege on the intarray extension. The vulnerability is in a selectivity estimator function that can be triggered through crafted queries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PostgreSQL 18.2, 17.8, 16.12, 15.16, or 14.21
Vendor Advisory: https://www.postgresql.org/support/security/CVE-2026-2004/
Restart Required: Yes
Instructions:
1. Backup your database. 2. Stop PostgreSQL service. 3. Upgrade to patched version using your distribution's package manager or PostgreSQL binaries. 4. Restart PostgreSQL service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable intarray extension
allRemove or disable the vulnerable intarray extension if not required
DROP EXTENSION intarray;
Restrict CREATE privileges
allRevoke CREATE privilege on intarray extension from non-admin users
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE ALL ON SCHEMA public FROM PUBLIC;
🧯 If You Can't Patch
- Disable the intarray extension immediately if not essential for operations
- Implement strict network controls to limit database access to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check PostgreSQL version with 'SELECT version();' and verify if intarray extension is installed with 'SELECT * FROM pg_extension WHERE extname = 'intarray';'Check Version:
SELECT version();Verify Fix Applied:
After patching, confirm version is 18.2, 17.8, 16.12, 15.16, 14.21 or higher with 'SELECT version();'📡 Detection & Monitoring
Log Indicators:
- Unusual queries involving intarray functions
- Failed authentication attempts followed by intarray-related queries
- Errors related to intarray selectivity estimator
Network Indicators:
- Unusual database connection patterns from unexpected sources
- High volume of complex queries to PostgreSQL
SIEM Query:
source="postgresql.log" AND ("intarray" OR "selectivity" OR "CVE-2026-2004")