CVE-2026-119922highCWE-266

CVE-2026-119922: fallo de gravedad alta en Amazon Aurora PostgreSQL with Babelfish

Babelfish for PostgreSQL Privilege Escalation

Publicada el 03 nov 2026 · Actualizada el 06 nov 2026

Seguir esta CVE + Monitorear Amazon Aurora PostgreSQL with Babelfish + Monitorear babelfish-for-postgresql

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Amazon · Amazon Aurora PostgreSQL with Babelfish AWS · babelfish-for-postgresql

CVEs relacionadas — Amazon Aurora PostgreSQL with Babelfish

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-119924HIGHOut-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name ParserEPSS —CVE-2026-119923CRITICALHeap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin ParserEPSS —

Referencias

https://aws.amazon.com/security/security-bulletins/2026-165-aws/https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35 https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14 https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10 https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4