Bulletin ID: 2026-165-AWS
Scope: AWS
Content Type: Important (requires attention)/Informational
Publication Date: 11/03/2026 10:00 AM PST

Description:

Babelfish for PostgreSQL extension enables users to run SQL Server workloads without modifying their applications. Babelfish is developed as an OpenSource project using the PostgreSQL’s extension model. It is owned and maintained by AWS at https://github.com/babelfish-for-postgresql/babelfish_extensions/.   

Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.

Impacted versions:

• 1.2-1.5
• 2.1-2.15
• 3.1-3.12
• 4.0-4.8
• 5.1-5.4

Resolution:

This issue has been addressed in Babelfish for PostgreSQL extension versions 4.10, 5.6 and 6.1 We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround for this issue. Upgrading to a patched version is required to remediate the issue.

References:

• CVE-2026-119922
• GHSA-fv9p-9rr9-fm35

Please email aws-security@amazon.com with any security questions or concerns.