Babelfish for PostgreSQL access control flaw allows privilege escalation

Summary

An improper access control flaw affects the Babelfish for PostgreSQL extension and Amazon Aurora PostgreSQL with Babelfish. A remote user who has logged in can raise their own privileges.

Affected when

• Babelfish for PostgreSQL extension in use
• remote login account (authenticated user)

What to do

Update the Babelfish for PostgreSQL extension to 4.10.0, 5.6.0, or 6.1.0 or later. On Aurora, upgrade the cluster to the listed version for your release or later and apply pending maintenance.

Update to at least the version for your product:

• babelfish-for-postgresql 4.x 4.10.0 or later
• babelfish-for-postgresql 5.x 5.6.0 or later
• babelfish-for-postgresql 6.x 6.1.0 or later

Products and platforms

• Amazon Aurora PostgreSQL with Babelfish
• babelfish-for-postgresql

CVE IDs

• CVE-2026-119922 (opens in a new tab)

Sources

• Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · aws.amazon.com (opens in a new tab)
• Write-up: github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 18:08 UTC

First seen 2026-11-09 14:50 UTC