CVE-2026-2004
Published: 12 February 2026
Summary
CVE-2026-2004 is a high-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Postgresql Postgresql. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2004 stems from missing validation of input types in the selectivity estimator function of PostgreSQL's intarray extension. This vulnerability affects PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database, as classified under CWE-1287.
The attack requires low privileges (PR:L), such as the ability to create database objects, and can be carried out remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling arbitrary code execution as the database process's OS user, with a CVSS v3.1 base score of 8.8.
The official PostgreSQL security advisory at https://www.postgresql.org/support/security/CVE-2026-2004/ recommends upgrading to one of the patched versions—18.2, 17.8, 16.12, 15.16, or 14.21—which incorporate input type validation to prevent the arbitrary code execution.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6183
Vulnerability details
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via remote exploitation of PostgreSQL intarray extension (public-facing DB server) with DB object creation leading to OS-level code execution under DB process privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation of flaws through vendor patches directly prevents exploitation of the missing input validation in PostgreSQL's intarray extension selectivity estimator.
Information input validation enforces type checking in database functions and extensions, directly addressing the root cause of arbitrary code execution via invalid inputs.
Least functionality restricts enabled extensions to only essential ones, preventing use of the vulnerable intarray extension if not required.