High8.8Red Hat Linux

High [CVE-2026-14680] Arbitrary code execution via type confusion with "internal" arguments

This high-severity Red Hat Linux advisory covers CVE-2026-14680 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.

CVE-2026-14680 Published Aug 13, 2026Updated by vendor Aug 13, 2026

CVE-2026-14680

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL.

The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

This type confusion flaw bypasses intended security boundaries for 'internal' data types, leading to a significant privilege escalation and potential compromise of the entire database server. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-843. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Self-service automation portal 2.

Red Hat lists Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6.

Red Hat does not currently list a fixing RHSA for this CVE.

Affected products named by the advisory: Red Hat package: postgresql16; Red Hat package: postgresql18.

Affected versions

< 18.5
< 17.11
< 16.15
< 15.19
< 14.24

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Restrict PostgreSQL to trusted hosts and bind only the required interfaces; use pg_hba.conf so only trusted clients can reach the port. Do not grant CONNECT (or any SQL login) to untrusted roles —any session can trigger this.

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.