RHSA-2026:73404
Vulnerability from csaf_redhat - Published: 2026-09-29 12:12 - Updated: 2026-09-30 23:40Summary
Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images
Severity
Important
Notes
Topic: Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.
Details: Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal
as a bootable container (bootc) image. The image provides a self-contained automation portal
with pre-configured services, dynamic plugins, and support for air-gapped deployments.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space without requiring any specific application bug.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in PostgreSQL psql. During the `COPY FROM STDIN` operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation requires the attacker to control both the server and the data being copied, or to leverage a coincidental error while controlling only the data.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server.
7.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could potentially allow an attacker to execute arbitrary code as the operating system user running the database.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the operating system user running the database.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain unauthorized insight into system memory.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A heap buffer overflow flaw was found in the PostgreSQL to_char(timestamptz) function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead to unauthorized access and control over the database system.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system user running the database.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes (0x0 and 0x1) to server memory, which may lead to unknown impacts.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A SQL injection flaw in PostgreSQL's EXTRACT() expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pg_dump or psql inspect or export the object.
8.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the `levenshtein()` or `levenshtein_less_equal()` SQL functions. This allows the user to execute arbitrary code as the operating system user running the database, potentially leading to full system compromise.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful exploitation could lead to a complete compromise of the database system.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pg_dump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim processes this manipulated dump, the injected code executes with the privileges of the operating system account running the psql client.
8.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
A flaw was found in PostgreSQL pg_dump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating system user running pg_dump.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-5038
Threats
Impact
Important
References
107 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal\nas a bootable container (bootc) image. The image provides a self-contained automation portal\nwith pre-configured services, dynamic plugins, and support for air-gapped deployments.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:73404",
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14662",
"url": "https://access.redhat.com/security/cve/CVE-2026-14662"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14664",
"url": "https://access.redhat.com/security/cve/CVE-2026-14664"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14668",
"url": "https://access.redhat.com/security/cve/CVE-2026-14668"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14669",
"url": "https://access.redhat.com/security/cve/CVE-2026-14669"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14670",
"url": "https://access.redhat.com/security/cve/CVE-2026-14670"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14671",
"url": "https://access.redhat.com/security/cve/CVE-2026-14671"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14677",
"url": "https://access.redhat.com/security/cve/CVE-2026-14677"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14679",
"url": "https://access.redhat.com/security/cve/CVE-2026-14679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14680",
"url": "https://access.redhat.com/security/cve/CVE-2026-14680"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15741",
"url": "https://access.redhat.com/security/cve/CVE-2026-15741"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15742",
"url": "https://access.redhat.com/security/cve/CVE-2026-15742"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16239",
"url": "https://access.redhat.com/security/cve/CVE-2026-16239"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18408",
"url": "https://access.redhat.com/security/cve/CVE-2026-18408"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19385",
"url": "https://access.redhat.com/security/cve/CVE-2026-19385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5038",
"url": "https://access.redhat.com/security/cve/CVE-2026-5038"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6464",
"url": "https://access.redhat.com/security/cve/CVE-2026-6464"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6471",
"url": "https://access.redhat.com/security/cve/CVE-2026-6471"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
"url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73404.json"
}
],
"title": "Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images",
"tracking": {
"current_release_date": "2026-09-30T23:40:56+00:00",
"generator": {
"date": "2026-09-30T23:40:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:73404",
"initial_release_date": "2026-09-29T12:12:27+00:00",
"revision_history": [
{
"date": "2026-09-29T12:12:27+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-29T12:12:28+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-30T23:40:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Automation Platform 2.2",
"product": {
"name": "Red Hat Ansible Automation Platform 2.2",
"product_id": "Red Hat Ansible Automation Platform 2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_portal:2.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Automation Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/bootc-automation-portal-rhel9@sha256%3A58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9\u0026tag=1790657374"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
"product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5038",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-06-15T16:01:19.525752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488935"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space without requiring any specific application bug.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "multer: Multer: Denial of Service via aborted or malformed multipart uploads",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `multer` when configured to use `diskStorage`. An attacker can exploit this flaw by initiating and then aborting or sending malformed multipart uploads, leading to the accumulation of orphaned partial files and eventual disk space exhaustion on affected Red Hat products that utilize `multer` for file handling.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5038"
},
{
"category": "external",
"summary": "RHBZ#2488935",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488935"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5038"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm",
"url": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm"
}
],
"release_date": "2026-06-15T14:23:24.230000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "multer: Multer: Denial of Service via aborted or malformed multipart uploads"
},
{
"cve": "CVE-2026-6464",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"discovery_date": "2026-08-13T13:21:12.187888+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515306"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL psql. During the `COPY FROM STDIN` operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation requires the attacker to control both the server and the data being copied, or to leverage a coincidental error while controlling only the data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the PostgreSQL psql client that could lead to arbitrary command execution. When using `COPY FROM STDIN`, untrusted data can be processed as psql commands if an error injection causes the command to fail prematurely. Exploitation requires an attacker to control both the PostgreSQL server and the data rows, or to leverage a coincidental error, which significantly limits the attack surface in typical Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6464"
},
{
"category": "external",
"summary": "RHBZ#2515306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515306"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6464"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6464/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6464/"
}
],
"release_date": "2026-08-13T13:00:16.158000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN"
},
{
"cve": "CVE-2026-6471",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-08-13T13:21:38.056528+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515307"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. Missing authorization in PostgreSQL\u0027s logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in PostgreSQL\u0027s logical decoding feature allows a non-superuser with the REPLICATION privilege to execute arbitrary code. Exploitation requires an attacker to already have significant access to the database, specifically the REPLICATION role, which is not granted by default to typical users, thus reducing the overall risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6471"
},
{
"category": "external",
"summary": "RHBZ#2515307",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515307"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6471"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6471",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6471"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6471/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6471/"
}
],
"release_date": "2026-08-13T13:00:18.050000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that the REPLICATION privilege is granted only to highly trusted database superusers. Regularly review user privileges to confirm that non-superuser accounts do not possess the REPLICATION privilege unless absolutely necessary and their activities are closely monitored. If logical decoding is not actively used, consider disabling it to further reduce the attack surface, though specific configuration steps for disabling logical decoding are beyond the scope of this mitigation.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin"
},
{
"cve": "CVE-2026-14662",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T13:20:57.973795+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515302"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could potentially allow an attacker to execute arbitrary code as the operating system user running the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in PostgreSQL where an unprivileged database user could achieve arbitrary code execution due to an integer wraparound in tsvector and tsquery functions. While direct exploitation by application users is considered unlikely as these functions are typically used by application logic, the flaw could still be leveraged in specific scenarios where crafted large inputs are processed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14662"
},
{
"category": "external",
"summary": "RHBZ#2515302",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515302"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14662",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14662"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14662",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14662"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14662/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14662/"
}
],
"release_date": "2026-08-13T13:00:01.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions"
},
{
"cve": "CVE-2026-14664",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-08-13T13:22:03.322433+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515311"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the operating system user running the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. A heap buffer overflow in the PostgreSQL regular expression engine allows an authenticated query author to execute arbitrary code as the database operating system user. This can lead to a complete compromise of the database server through specially crafted input that bypasses encoding validation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14664"
},
{
"category": "external",
"summary": "RHBZ#2515311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515311"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14664"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14664",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14664"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14664/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14664/"
}
],
"release_date": "2026-08-13T13:00:03.074000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Restrict PostgreSQL to trusted hosts and bind only required interfaces. Do not grant CONNECT to untrusted roles; any session that can run SQL can call regexp_match / regexp_matches / regexp_split_to_*. If those functions are unused, REVOKE EXECUTE on them from PUBLIC.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp"
},
{
"cve": "CVE-2026-14668",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-08-13T13:23:22.898631+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515326"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain unauthorized insight into system memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important-rated information disclosure vulnerability in PostgreSQL allows an authenticated user with object creation privileges to read arbitrary memory spans. By exploiting a type confusion flaw within the ctid selectivity estimator, an attacker can view memory-derived calculations to recover sensitive data. Exploitation is limited to users possessing object creation rights",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14668"
},
{
"category": "external",
"summary": "RHBZ#2515326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14668"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14668",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14668"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14668/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14668/"
}
],
"release_date": "2026-08-13T13:00:04.405000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, administrators should enforce the principle of least privilege by revoking CREATE permissions on all databases from untrusted users. Because exploiting this flaw strictly requires the attacker to be an object creator, removing this privilege effectively neutralizes the threat. Ensure only highly trusted administrative roles can create database objects",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator"
},
{
"cve": "CVE-2026-14669",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-08-13T13:22:41.824137+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515317"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow flaw was found in the PostgreSQL to_char(timestamptz) function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database\u0027s operating system user, potentially resulting in complete system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap buffer overflow in PostgreSQL\u0027s to_char(timestamptz) function allows an attacker to execute arbitrary code as the database system user by supplying a long POSIX timezone abbreviation. This risk is highest where untrusted users can modify timezone settings.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14669"
},
{
"category": "external",
"summary": "RHBZ#2515317",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515317"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14669"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14669",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14669"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14669/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14669/"
}
],
"release_date": "2026-08-13T13:00:04.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To reduce the risk of exploitation, ensure that only trusted users have privileges to modify timezone settings within the PostgreSQL database. Additionally, restrict network access to the PostgreSQL server to only trusted clients and applications through firewall rules, limiting the attack surface for remote exploitation.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation"
},
{
"cve": "CVE-2026-14670",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-08-13T13:23:32.202372+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515325"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead to unauthorized access and control over the database system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PostgreSQL\u0027s plperl component allows a function owner to achieve arbitrary code execution as the database operating system user. By crafting a malicious function body, an attacker with low privileges can exploit a heap buffer overflow, leading to full compromise of the database system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14670"
},
{
"category": "external",
"summary": "RHBZ#2515325",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515325"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14670"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14670",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14670"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14670/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14670/"
}
],
"release_date": "2026-08-13T13:00:05.626000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Disable the plperl procedural language if it is not actively required by executing DROP LANGUAGE plperl; on affected databases. Alternatively, restrict access by revoking USAGE privileges on plperl from untrusted roles. These actions prevent the execution of crafted plperl functions, mitigating the risk(a database restart may be required to clear active sessions).",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow"
},
{
"cve": "CVE-2026-14671",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-08-13T13:23:10.662262+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515322"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A type confusion vulnerability in the \u0027refint\u0027 module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in \u0027refint\u0027 module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important-rated type confusion vulnerability in PostgreSQL\u0027s refint module allows an authenticated user with object creation privileges to execute arbitrary code. Successful exploitation results in a complete compromise of the database server, as the code executes under the context of the database\u0027s operating system user.\"",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14671"
},
{
"category": "external",
"summary": "RHBZ#2515322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515322"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14671"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14671",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14671"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14671/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14671/"
}
],
"release_date": "2026-08-13T13:00:18.697000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, administrators should avoid installing the refint module and remove it if it is currently deployed by executing DROP EXTENSION refint; as a database superuser. Additionally, enforcing the principle of least privilege by revoking CREATE permissions on databases from untrusted users prevents them from creating the malicious objects necessary to exploit this flaw.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in \u0027refint\u0027 module"
},
{
"cve": "CVE-2026-14677",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-08-13T13:22:34.088665+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515313"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system user running the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PostgreSQL\u0027s 32-bit pltcl and plperl extensions allows an authenticated object creator to achieve arbitrary code execution as the database operating system user. The flaw stems from an integer wraparound, leading to out-of-bounds writes when processing crafted function bodies. Exploitation requires specific conditions related to 32-bit environments and the ability to create objects within the database.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14677"
},
{
"category": "external",
"summary": "RHBZ#2515313",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515313"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14677"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14677",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14677"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14677/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14677/"
}
],
"release_date": "2026-08-13T13:00:08.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable or remove the `pltcl` and `plperl` extensions if they are not essential for your PostgreSQL deployment, particularly in 32-bit environments. This can be done by revoking `CREATE` privilege on `LANGUAGE pltcl` and `LANGUAGE plperl` from untrusted users. If these extensions are necessary, ensure that only trusted users possess object creation privileges within the database.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl"
},
{
"cve": "CVE-2026-14679",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2026-08-13T13:23:39.637833+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515321"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes (0x0 and 0x1) to server memory, which may lead to unknown impacts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important PostgreSQL stack buffer overflow allows an authenticated object creator to trigger unknown impacts by manipulating OUT parameter counts. While requiring existing database privileges, successful exploitation could lead to service disruption and minor data integrity issues, elevating the risk beyond a Moderate classification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14679"
},
{
"category": "external",
"summary": "RHBZ#2515321",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515321"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14679"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14679/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14679/"
}
],
"release_date": "2026-08-13T13:00:09.371000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation"
},
{
"cve": "CVE-2026-14680",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-08-13T13:21:57.012683+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515308"
}
],
"notes": [
{
"category": "description",
"text": "A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database\u0027s operating system user by calling functions with mishandled \"internal\" data type arguments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability where any authenticated PostgreSQL user can achieve arbitrary code execution as the operating system user running the database. This type confusion flaw bypasses intended security boundaries for \u0027internal\u0027 data types, leading to a significant privilege escalation and potential compromise of the entire database server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14680"
},
{
"category": "external",
"summary": "RHBZ#2515308",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515308"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14680"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14680",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14680"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14680/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14680/"
}
],
"release_date": "2026-08-13T13:00:10.037000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Restrict PostgreSQL to trusted hosts and bind only the required interfaces; use pg_hba.conf so only trusted clients can reach the port. Do not grant CONNECT (or any SQL login) to untrusted roles \u2014any session can trigger this.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments"
},
{
"cve": "CVE-2026-15741",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2026-08-13T13:24:21.781976+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515332"
}
],
"notes": [
{
"category": "description",
"text": "A SQL injection flaw in PostgreSQL\u0027s EXTRACT() expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pg_dump or psql inspect or export the object.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important-rated SQL injection vulnerability in PostgreSQL\u0027s EXTRACT() expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By crafting a hostile database object, an attacker can trigger privilege escalation when administrative tools like pg_dump or psql process the object. This poses a significant risk to environments where non-administrative users are granted object creation rights.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15741"
},
{
"category": "external",
"summary": "RHBZ#2515332",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515332"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15741",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15741"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15741",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15741"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-15741/",
"url": "https://www.postgresql.org/support/security/CVE-2026-15741/"
}
],
"release_date": "2026-08-13T13:00:11.206000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, administrators should strictly limit database object creation privileges to highly trusted users. When performing backups or database introspection using pg_dump or psql, exercise caution when operating on databases that allow untrusted users to define objects,",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse"
},
{
"cve": "CVE-2026-15742",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-08-13T13:22:19.400516+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515314"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the `levenshtein()` or `levenshtein_less_equal()` SQL functions. This allows the user to execute arbitrary code as the operating system user running the database, potentially leading to full system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in the PostgreSQL `fuzzystrmatch` extension is rated as Important. A low-privileged database user could achieve arbitrary code execution as the operating system user running the database. This risk is present only when the `fuzzystrmatch` extension is explicitly installed and utilized, as it is not enabled by default in Red Hat deployments. The flaw stems from an integer wraparound when processing extreme inputs to specific SQL functions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15742"
},
{
"category": "external",
"summary": "RHBZ#2515314",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515314"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15742",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15742"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15742",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15742"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-15742/",
"url": "https://www.postgresql.org/support/security/CVE-2026-15742/"
}
],
"release_date": "2026-08-13T13:00:11.796000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this issue, consider disabling the `fuzzystrmatch` extension within PostgreSQL if its functionality is not essential. Alternatively, the `postgresql-fuzzystrmatch` package can be removed. Disabling or removing the extension may affect applications that rely on the `levenshtein()` or `levenshtein_less_equal()` functions. A database service restart may be required for these changes to take effect.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound"
},
{
"cve": "CVE-2026-16239",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-08-13T13:22:28.331979+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515316"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the \u0027portal\u0027/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful exploitation could lead to a complete compromise of the database system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in PostgreSQL. A type confusion flaw in the cursor lifecycle allows a low-privileged authenticated database user to execute arbitrary code as the operating system user running the database. This can lead to a complete compromise of the database system, making it a significant risk in typical Red Hat deployments where PostgreSQL instances are exposed to authenticated users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16239"
},
{
"category": "external",
"summary": "RHBZ#2515316",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515316"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16239"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16239",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16239"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-16239/",
"url": "https://www.postgresql.org/support/security/CVE-2026-16239/"
}
],
"release_date": "2026-08-13T13:00:13.131000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, restrict direct database access strictly to trusted roles and minimize multi-tenant database scenarios where untrusted users can execute arbitrary SQL. Monitor database audit logs for anomalous or high-frequency cursor lifecycle activities involving unexpected CLOSE and DECLARE operations.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle"
},
{
"cve": "CVE-2026-18408",
"cwe": {
"id": "CWE-829",
"name": "Inclusion of Functionality from Untrusted Control Sphere"
},
"discovery_date": "2026-08-13T13:21:05.112091+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515303"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pg_dump export, the attacker can exploit the input expansion of the psql \\restrict meta-command. When a victim processes this manipulated dump, the injected code executes with the privileges of the operating system account running the psql client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important-rated vulnerability in PostgreSQL allows a malicious superuser on an origin server to compromise client systems during a database restore. By injecting arbitrary code into a database dump, the attacker can trigger execution when the file is processed by a victim\u0027s psql client. This runs the malicious code with the operating system privileges of the user performing the restore, effectively escalating access from the compromised database server to the client machine.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18408"
},
{
"category": "external",
"summary": "RHBZ#2515303",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515303"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18408"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18408",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18408"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-18408/",
"url": "https://www.postgresql.org/support/security/CVE-2026-18408/"
}
],
"release_date": "2026-08-13T13:00:14.898000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, administrators should avoid generating or restoring pg_dump files from untrusted or public origin servers using the psql client. If restoring a plain-format dump from an unverified source is strictly necessary, manually inspect the file for unauthorized \\restrict or \\unrestrict meta-commands before execution, or isolate the restore process in a sandboxed environment",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump"
},
{
"cve": "CVE-2026-19385",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-08-13T13:24:39.300405+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515328"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL pg_dump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating system user running pg_dump.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A heap buffer overflow in PostgreSQL pg_dump allows authenticated database users to execute arbitrary code. Attackers with object-creation privileges can use crafted function transform lists to run OS commands as the backup user.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19385"
},
{
"category": "external",
"summary": "RHBZ#2515328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515328"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19385"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-19385/",
"url": "https://www.postgresql.org/support/security/CVE-2026-19385/"
}
],
"release_date": "2026-08-13T13:00:15.490000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-29T12:12:27+00:00",
"details": "For more about Ansible Portal Installer Bootc, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73404"
},
{
"category": "workaround",
"details": "Restrict database user privileges, particularly object creation, to trusted administrators only. Ensure that `pg_dump` operations are performed by users with the least necessary operating system privileges to limit the impact of potential code execution.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:58480702819796209b8cda6fe1b53ad78870575432da34ecfdc20cd446c8d81b_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…