What is CVE-2026-6469?
In PostgreSQL, the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This allows the table owner to execute DROP STATISTICS and ALTER STATISTICS commands via improper ownership, while improperly denying these commands to the legitimate owner. Affected PostgreSQL instances should be updated promptly.
Azərbaycanca: PostgreSQL-də ALTER TABLE ALTER TYPE əmri statistika obyektlərinin mülkiyyətini səhvən cari istifadəçiyə ötürür. Bu, cədvəl sahibinə DROP/ALTER STATISTICS əmrlərini icra etməyə imkan verir, əsl sahibinə isə həmin hüquqları rədd edir. Təsirlənmiş PostgreSQL versiyalarını mümkün qədər tez yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-732
FAQ1
What security issue occurs with the ownership of statistics objects when running the `ALTER TABLE ALTER TYPE` command in PostgreSQL?
According to CVE-2026-6469, this command incorrectly reassigns ownership of dependent statistics objects to the current user. As a result, the table owner can execute `DROP STATISTICS` and `ALTER STATISTICS` commands via improper ownership, while the legitimate owner is improperly denied these commands.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.