AWS warns of privilege escalation flaw CVE-2026-119922 in Babelfish for PostgreSQL
VULNERABILITYCVE-2026-119922redteam/daily · 1 source
- Severity
- Medium
- Highest CVSS
- 8.7
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-119922 is an improper access control flaw in Babelfish for PostgreSQL that lets remote authenticated users elevate privileges. Affected extension versions are 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8 and 5.1-5.4. AWS recommends upgrading to the fixed extension versions, which are not named in the available text (bulletin 2026-165-AWS). Defenders should inventory Babelfish deployments, check the installed version against the affected ranges and prioritise upgrades, limiting database accounts to least privilege in the meantime.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether Babelfish for PostgreSQL is installed and which extension version is in use.
- Upgrade Babelfish for PostgreSQL to a fixed extension version, as recommended in the AWS bulletin 2026-165-AWS.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies
Products