CVE-2026-119922
Babelfish for PostgreSQL Privilege Escalation
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
| CWE | CWE-266 |
| Vendor | aws |
| Product | babelfish-for-postgresql |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for aws babelfish-for-postgresql
Be the first to know when new high vulnerabilities affecting aws babelfish-for-postgresql are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
AWS / babelfish-for-postgresql
1.2 ≤ 1.5 2.1 ≤ 2.15 3.1 ≤ 3.12 4.0 ≤ 4.8 5.1 ≤ 5.4
References
github.com: https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14 github.com: https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10 github.com: https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4 aws.amazon.com: https://aws.amazon.com/security/security-bulletins/2026-165-aws/ github.com: https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35