---
id: CVE-2026-119922
title: Babelfish for PostgreSQL Privilege Escalation
summary: >-
  Improper access control in the Babelfish for PostgreSQL extension versions
  1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated
  users to elevate their privileges. To remediate this issue, we recommend you
  upgrade …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-266
vendor: AWS
product: babelfish-for-postgresql
affected:
  - babelfish-for-postgresql >= 1.2 <= 1.5
  - babelfish-for-postgresql >= 2.1 <= 2.15
  - babelfish-for-postgresql >= 3.1 <= 3.12
  - babelfish-for-postgresql >= 4.0 <= 4.8
  - babelfish-for-postgresql >= 5.1 <= 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T20:13:35.320527Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:13:48.531Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119922'
references:
  - url: >-
      https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14
  - url: >-
      https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10
  - url: >-
      https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-165-aws/'
  - url: >-
      https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35
tags:
  - cve.org
epss: 0.00549
epssPercentile: 0.46069
ingestedAt: '2026-11-05T20:33:06.433Z'
---

## Overview

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.

## Affected

- `babelfish-for-postgresql >= 1.2 <= 1.5`
- `babelfish-for-postgresql >= 2.1 <= 2.15`
- `babelfish-for-postgresql >= 3.1 <= 3.12`
- `babelfish-for-postgresql >= 4.0 <= 4.8`
- `babelfish-for-postgresql >= 5.1 <= 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.