CVE-2026-119923: Critical RCE in Babelfish for PostgreSQL

CVE-2026-119923 is a heap buffer overflow and NULL-pointer-dereference vulnerability in the TDS prelogin parser of Babelfish for PostgreSQL extension and Amazon Aurora PostgreSQL with Babelfish. The flaw allows remote attackers to execute arbitrary OS commands with the privileges of the database process user without authentication. It affects critical versions of the extension (1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4) and multiple Aurora PostgreSQL versions.

Severity is declared critical with CVSS 9.8, as access is remote, the attack vector is the TDS prelogin protocol (default port 1433), and the impact is arbitrary code execution with elevated database process privileges. The vulnerability was officially published by NVD on November 6, 2026, and official patches are available from AWS with specific versions for each Aurora PostgreSQL version. Signals on X confirm spread of awareness of the flaw among administrators and security teams over the last two days.

For defense: immediately install correct versions of Babelfish extension (4.10, 5.6, 6.1 or later) or upgrade Aurora PostgreSQL cluster to AWS-specified patch versions (from 13.9.16 to 18.4.1 depending on current version). As temporary mitigation, restrict network access to TDS port (default 1433) to authorized systems only using security groups and network firewalls. Audit Aurora PostgreSQL cluster inventory with active Babelfish and schedule priority maintenance window.