Vulnerability · Published Sep 24, 2026 · Assigned by AMZN

CVE-2026-96883Type confusion in AWS pgcollection allows remote code execution

High 8.8

In plain English

A high-severity type confusion in pgcollection from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 48.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade to version 2.1.2 or later.

Affected products (as reported)

Vendor	Product	Versions
AWS	pgcollection	2.0.0 – through 2.1.1

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/aws/pgcollection/releases/tag/v2.1.2 release-notes, patch
https://aws.amazon.com/security/security-bulletins/2026-118-aws/ vendor-advisory
https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r third-party-advisory