Description

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-08-13T13:17:44.783Z",
  "pubdate": "2026-08-13T13:17:44.783Z",
  "executiveSummary": "An untrusted search path vulnerability exists in the PostgreSQL amcheck extension. The vulnerability allows a malicious user granted EXECUTE privilege on amcheck functions to execute arbitrary functions as the owners of expression indexes that depend on the search path.\nThe impact includes privilege escalation and execution of arbitrary code under the security context of the expression index owner.\nAffected products include PostgreSQL major versions 18, 16, 15, and 14, specifically minor versions prior to PostgreSQL 18.5, 16.15, 15.19, and 14.24, while PostgreSQL 17 remains unaffected.\nThe risk implications are significant for multi-tenant or shared database environments where users have restricted database privileges but can manipulate search paths.\nAttacker capabilities require EXECUTE privilege on the amcheck functions and the ability to set a hostile search path prior to invoking the vulnerable function.",
  "technicalDetails": "The root cause of the vulnerability lies in an insecure search path handling mechanism within the PostgreSQL amcheck extension. When amcheck functions inspect expression indexes, they execute database objects within an untrusted schema resolution context.\nThe vulnerable component is the amcheck extension within PostgreSQL. Affected versions include major versions 18, 16, 15, and 14, specifically minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24.\nPrivilege requirements include having EXECUTE privilege on the amcheck functions. Authentication to the database is required, but direct superuser privileges are not initially necessary for the attacker.\nThe exploitation method involves the attacker configuring a hostile search path within their session before invoking an amcheck function. Because the amcheck functions process expression indexes while respecting the caller's search path, the database engine resolves unqualified function or operator names to malicious objects planted by the attacker within the hostile schema.\nThe step-by-step attack flow proceeds as follows: First, the attacker establishes a database session and alters their search path to prioritize a schema under their direct control. Second, the attacker populates this controlled schema with malicious functions or operators that share names with legitimate objects relied upon by expression indexes. Third, the attacker calls the amcheck function, which traverses the expression indexes. Fourth, during the inspection of expression indexes, the database resolves name lookups using the attacker's hostile search path rather than secure defaults. Finally, the malicious functions execute with the elevated privileges of the expression index owner, achieving privilege escalation.\nThe post-exploitation impact allows the attacker to execute arbitrary code or queries under the security context of other database users who own the affected expression indexes."
}