CVE-2026-96883

Summary

The flaw is a type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 that allows an authenticated remote user to execute arbitrary code as the postgres operating system user. This is due to crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions.

Exploitability

Exploitation is moderately hard as it requires an authenticated user and crafted SQL statements. Precondition is the presence of the vulnerable version of pgcollection and an authenticated user with SQL injection capabilities.

Blast radius

If exploited, this flaw could result in complete compromise of the PostgreSQL server, allowing the attacker to execute arbitrary code with the privileges of the postgres user.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AWS pgcollection 2.1.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.