{"id":"CVE-2026-119922","title":"Babelfish for PostgreSQL Privilege Escalation","summary":"Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-266"],"vendor":"AWS","product":"babelfish-for-postgresql","affected":["babelfish-for-postgresql >= 1.2 <= 1.5","babelfish-for-postgresql >= 2.1 <= 2.15","babelfish-for-postgresql >= 3.1 <= 3.12","babelfish-for-postgresql >= 4.0 <= 4.8","babelfish-for-postgresql >= 5.1 <= 5.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T20:13:35.320527Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:13:48.531Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119922","references":[{"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14"},{"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10"},{"url":"https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-165-aws/"},{"url":"https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35"}],"tags":["cve.org"],"epss":0.00549,"epssPercentile":0.46069,"ingestedAt":"2026-11-05T20:33:06.433Z","slug":"CVE-2026-119922","body":"## Overview\n\nImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.\n\n## Affected\n\n- `babelfish-for-postgresql >= 1.2 <= 1.5`\n- `babelfish-for-postgresql >= 2.1 <= 2.15`\n- `babelfish-for-postgresql >= 3.1 <= 3.12`\n- `babelfish-for-postgresql >= 4.0 <= 4.8`\n- `babelfish-for-postgresql >= 5.1 <= 5.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}