# CVE-2026-119922: Babelfish for PostgreSQL Privilege Escalation

> CVE-2026-119922: Babelfish for PostgreSQL Privilege Escalation. CVSS 8.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-119922
Last updated: 2026-11-06T19:17:39Z

- Published: 2026-11-03 18:08 UTC · Updated: 2026-11-06 19:17 UTC · Assigner: AMZN
- CVSS: 8.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.55%, 46th percentile (scored 2026-11-10)
- CISA KEV: no
- CWE: CWE-266

## Description

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.

## Affected vendors and products

- Amazon: Amazon Aurora PostgreSQL with Babelfish
- AWS: babelfish-for-postgresql

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-119922)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-119922)
- [https://aws.amazon.com/security/security-bulletins/2026-165-aws/](https://aws.amazon.com/security/security-bulletins/2026-165-aws/)
- [https://github.com/babelfish-for-postgresql/babelfish\_extensions/security/advisories/GHSA-fv9p-9rr9-fm35](https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35)
- [https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL\_4\_10\_0\_\_PG\_16\_14](https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14)
- [https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL\_5\_6\_0\_\_PG\_17\_10](https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10)
- [https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL\_6\_1\_0\_\_PG\_18\_4](https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-119922 · Markdown: https://rewindex.com/cve/CVE-2026-119922.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-119922 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T04:59:33.766Z