Vulnerability · Published Nov 3, 2026 · Assigned by AMZN
CVE-2026-119922Babelfish for PostgreSQL Privilege Escalation
High 8.8
In plain English
A high-severity security flaw in babelfish-for-postgresql from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWS | babelfish-for-postgresql | 1.2 – through 1.52.1 – through 2.153.1 – through 3.124.0 – through 4.85.1 – through 5.4 |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14 release-notes, patch
- https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10 release-notes, patch
- https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4 release-notes, patch
- https://aws.amazon.com/security/security-bulletins/2026-165-aws/ vendor-advisory
- https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35 third-party-advisory