What is CVE-2026-119922 and how does it affect security?
CVE-2026-119922 is a critical security vulnerability discovered in the Babelfish for PostgreSQL extension, carrying a CVSS score of 8.8. This flaw stems from improper access control, mapped to CWE-266, which could potentially expose databases to privilege escalation vectors. For broader context on privilege escalation issues, you might want to review CVE-2026-58946 critical flaw as well as CVE-2026-58957 privilege escalation.
The vulnerability specifically impacts remote authenticated users, meaning an attacker must already possess valid credentials to attempt exploitation. Similar issues like CVE-2026-59044 use-after-free demonstrate the ongoing focus on privilege boundaries in enterprise software components.
Who is affected by this privilege escalation vulnerability?
The vulnerability affects a broad range of legacy and recent iterations of the Babelfish extension. Specifically, versions 1.2 through 1.5, 2.1 through 2.15, 3.1 through 3.12, 4.0 through 4.8, and 5.1 through 5.4 are confirmed to be vulnerable.
Administrators running database environments utilizing these specific version ranges are urged to evaluate their software inventory against the official advisories published on [[https://aws.amazon.com/security/security-bulletins/2026-165-aws/|AWS Security Bulletins]].
How do I protect my system against CVE-2026-119922?
To properly mitigate CVE-2026-119922, administrators must upgrade their database extensions to secure versions. The maintainers have released patches addressing the improper access control mechanism.
Follow these steps to secure your deployment:
Review your current Babelfish extension version using SQL queries or package managers.
Consult the official repository releases at [[https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4|GitHub Releases]]. Alternatively, check [[https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14|Babelfish release notes]] and [[https://github.com/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35|GitHub Security Advisory]] for precise update binaries and instructions.
- Identify the installed version of Babelfish for PostgreSQL.
- Download the patched version 4.10, 5.6, 6.1 or later.
- Apply the update following standard database extension upgrade procedures.