Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Babelfish for PostgreSQL に権限昇格の脆弱性が見つかったよ Babelfish for PostgreSQL の一部バージョンに、認証済みのリモートユーザーが権限昇格できる問題が見つかったよ。 対象環境は影響範囲を確認して、AWS Security Bulletin に沿って更新を進めてね。 CVE-2026-119922 - Babelfish for PostgreSQL Privilege Escalation https://aws.amazon.com/security/security-bulletins/2026-165-aws/
☁️ AWS Babelfish for PostgreSQL Flaw Lets Users Escalate to Admin (CVE-2026-119922) Babelfish lets PostgreSQL run SQL Server workloads. When it translates T-SQL into PostgreSQL queries, it doesn't fully validate role-based permissions. An authenticated database user can exploit this to escalate privileges, potentially to database admin. CVSS 8.8 (High). 📦 Affected Babelfish releases ▪️ 1.2–1.5, 2.1–2.15, 3.1–3.12 ▪️ 4.0–4.8, 5.1–5.4 ▪️ On Amazon RDS and self-hosted PostgreSQL ✅ Fixed: 4.10, 5.6 and 6.1 or later 🔬 Key points ▪️ The attacker needs a valid database account ▪️ Exploitable remotely ▪️ No public exploit disclosed 🛡️ What to do now 1️⃣ Upgrade to 4.10, 5.6 or 6.1+ 2️⃣ Check your version with SELECT babelfish_version(); 3️⃣ Remove unnecessary privileged roles 4️⃣ Enable RDS audit and PostgreSQL logging 5️⃣ Backport the fix to any custom Babelfish forks 📖 Full analysis: https://badgersignal.com/articles/aws-babelfish-for-postgresql-extension-privilegeescalation-vulnerability-cve2026119922 #AWS #PostgreSQL #Babelfish #CloudSecurity #DatabaseSecurity #PrivilegeEscalation #CVE #CyberSecurity #BadgerSignal