CVE-2007-2138: Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13,...

Security readout for executives and security teams

This is an old PostgreSQL privilege escalation issue. A logged-in database user could potentially gain the privileges of a SECURITY DEFINER function owner if vulnerable PostgreSQL search path handling is present. The risk is mainly for legacy PostgreSQL deployments and databases where untrusted authenticated users can call privileged functions. Exposure is most likely in obsolete PostgreSQL 7.3 through 8.2 deployments, especially shared or application databases where less-trusted authenticated users can invoke SECURITY DEFINER functions. Prioritize if any legacy PostgreSQL instance remains in production or supports multi-user database access. For modern PostgreSQL versions, urgency is lower, but legacy inventory should be verified because the affected versions are far beyond normal support windows. Mitigation focus: Upgrade PostgreSQL to the fixed branch versions or later.; Apply the relevant operating system vendor security update where PostgreSQL is packaged.; Restrict untrusted users from invoking SECURITY DEFINER functions until patched..

Prepared

Jun 29, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.