Read the docs
TI-2026-84462 Aliases CVE-2026-119922

Improper access control in Babelfish for PostgreSQL enables privilege escalation

Priority MEDIUM 40CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Babelfish for PostgreSQL extension versions 1.2 through 1.5, 2.1 through 2.15, 3.1 through 3.12, 4.0 through 4.8 and 5.1 through 5.4, and Amazon Aurora PostgreSQL with Babelfish, are affected. Improper access control (CWE-266) lets a remote authenticated user with low privileges gain higher privileges, with high impact to confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Fixed Amazon Aurora PostgreSQL with Babelfish (Amazon): 1.5.5, 1.17.2, 2.3.5 +21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSbabelfish-for-postgresql1.2 – 1.5; 2.1 – 2.15; 3.1 – 3.12; 4.0 – 4.8; 5.1 – 5.4—No fix listedCNA
AWSAmazon Aurora PostgreSQL with Babelfish1.0.0 to before 1.5.5; 1.6.0 to before 1.17.2; 2.0.0 to before 2.3.5; 2.4.0 to before 2.12.4; 2.13.0 to before 2.13.3; 2.14.0 to before 2.14.2; 2.15.0 to before 2.15.2; 2.16.0 to before 2.16.1; 3.0.0 to before 3.8.4; 3.9.0 to before 3.9.4; 3.10.0 to before 3.10.3; 3.11.0 to before 3.11.2; 3.12.0 to before 3.12.2; 3.13.0 to before 3.13.1; 4.0.0 to before 4.5.5; 4.6.0 to before 4.6.3; 4.7.0 to before 4.7.2; 4.8.0 to before 4.8.2; 4.9.0 to before 4.9.1; 5.0.0 to before 5.1.4; 5.2.0 to before 5.2.3; 5.3.0 to before 5.3.2; 5.4.0 to before 5.4.2; 5.5.0; 6.0.0 to before 6.0.21.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, 2.14.2, 2.15.2, 2.16.1, 3.8.4, 3.9.4, 3.10.3, 3.11.2, 3.12.2, 3.13.1, 4.5.5, 4.6.3, 4.7.2, 4.8.2, 4.9.1, 5.1.4, 5.2.3, 5.3.2, 5.4.2, 6.0.2Patch availableCNA
  • babelfish-for-postgresql VendorAWS Affected 1.2 – 1.5; 2.1 – 2.15; 3.1 – 3.12; 4.0 – 4.8; 5.1 – 5.4 Fixed in — No fix listed CNA
  • Amazon Aurora PostgreSQL with Babelfish VendorAWS Affected 1.0.0 to before 1.5.5; 1.6.0 to before 1.17.2; 2.0.0 to before 2.3.5; 2.4.0 to before 2.12.4; 2.13.0 to before 2.13.3; 2.14.0 to before 2.14.2; 2.15.0 to before 2.15.2; 2.16.0 to before 2.16.1; 3.0.0 to before 3.8.4; 3.9.0 to before 3.9.4; 3.10.0 to before 3.10.3; 3.11.0 to before 3.11.2; 3.12.0 to before 3.12.2; 3.13.0 to before 3.13.1; 4.0.0 to before 4.5.5; 4.6.0 to before 4.6.3; 4.7.0 to before 4.7.2; 4.8.0 to before 4.8.2; 4.9.0 to before 4.9.1; 5.0.0 to before 5.1.4; 5.2.0 to before 5.2.3; 5.3.0 to before 5.3.2; 5.4.0 to before 5.4.2; 5.5.0; 6.0.0 to before 6.0.2 Fixed in 1.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, 2.14.2, 2.15.2, 2.16.1, 3.8.4, 3.9.4, 3.10.3, 3.11.2, 3.12.2, 3.13.1, 4.5.5, 4.6.3, 4.7.2, 4.8.2, 4.9.1, 5.1.4, 5.2.3, 5.3.2, 5.4.2, 6.0.2 Patch available CNA

Remediation

Upgrade the Babelfish for PostgreSQL extension to version 4.10, 5.6, 6.1 or later. Upgrade Amazon Aurora PostgreSQL with Babelfish clusters to the fixed versions 1.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, 2.14.2, 2.15.2, 2.16.1, 3.8.4, 3.9.4, 3.10.3, 3.11.2, 3.12.2, 3.13.1, 4.5.5, 4.6.3, 4.7.2, 4.8.2, 4.9.1, 5.1.4, 5.2.3, 5.3.2, 5.4.2 or 6.0.2 or later, and apply any pending maintenance.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Amazon Aurora PostgreSQL with Babelfish (Amazon) Fixed in 1.5.5, 1.17.2, 2.3.5, 2.12.4, 2.13.3, 2.14.2, 2.15.2, 2.16.1, 3.8.4, 3.9.4, 3.10.3, 3.11.2, 3.12.2, 3.13.1, 4.5.5, 4.6.3, 4.7.2, 4.8.2, 4.9.1, 5.1.4, 5.2.3, 5.3.2, 5.4.2, 6.0.2

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-119922
  2. 2026-11-03 1 new reference · CNA
  3. 2026-11-05 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Fix available: Amazon/Amazon Aurora PostgreSQL with [email protected], Amazon/Amazon Aurora PostgreSQL with [email protected], Amazon/Amazon Aurora PostgreSQL with [email protected] +21 · CNA
  5. 2026-11-06 2 new references · CNA
  6. 2026-11-06 CISA SSVC decision points changed
  7. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 3

Advisory 2

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
  • TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
  • TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
  • TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences