Babelfish for PostgreSQL: Privilege escalation via improper access control
Summary
Improper access control in the Babelfish for PostgreSQL extension allows remote authenticated users to elevate their privileges. The CNA rates the issue CVSS 4.0 8.7 (High). An attacker needs a valid database account, but no user interaction is required.
Affected
- Babelfish for PostgreSQL extension versions 1.2 to 1.5
- Versions 2.1 to 2.15
- Versions 3.1 to 3.12
- Versions 4.0 to 4.8
- Versions 5.1 to 5.4
Fixed in
- Upgrade to extension version 4.10, 5.6 or 6.1 (or later)
- Unknown whether 1.x and 2.x branches have fixed releases; no fixed version is stated for them
Workaround
- No workaround. Upgrading to a patched version is required.
Exploitation
- No public proof of concept or exploit is known according to VulDB.
- Not known to be exploited in the wild according to an aggregator; not verified in CISA KEV.
Our recommendation
- Check whether Babelfish is deployed and which extension version is running.
- Upgrade to 4.10, 5.6, 6.1 or later; follow the vendor's instructions for managed environments.
- Review database accounts with access to Babelfish and remove unused accounts, as an attacker must be authenticated.
- Restrict access to the TDS (1433) and PostgreSQL (5432) ports to necessary clients and monitor for unusual privilege changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-165-AWS aws.amazon.com
- GitHub Security Advisory GHSA-fv9p-9rr9-fm35 github.com
- Babelfish release BABEL_4_10_0__PG_16_14 github.com
- Babelfish release BABEL_5_6_0__PG_17_10 github.com
- Babelfish release BABEL_6_1_0__PG_18_4 github.com
- VulDB entry 430521 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 20:22.
Original description (NVD)
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
NVD references (5)
- https://aws.amazon.com/security/security-bulletins/2026-165-aws/
- https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_4_10_0__PG_16_14
- https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases#release-BABEL_5_6_0__PG_17_10
- https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4
- https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.