CVE-2026-6472 — Missing authorization in PostgreSQL CREATE TYPE allows an

title: CVE-2026-6472 PostgreSQL CREATE TYPE Abuse - Free Tier
id: scw-2026-05-14-ai-1
status: experimental
level: high
description: |
  Detects the specific PostgreSQL CREATE TYPE command used in CVE-2026-6472. This command, when exploited, allows an attacker to hijack queries by creating a user-defined type that can then be used to execute arbitrary SQL functions. This rule specifically looks for the 'CREATE TYPE' command along with parameters often associated with the exploit, such as 'FROM:', 'schema=', and 'name='.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6472/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: process_creation
detection:
  selection:
      Image|contains:
          - 'postgres.exe'
      CommandLine|contains:
          - 'CREATE TYPE'
      CommandLine|contains:
          - 'FROM:'
      CommandLine|contains:
          - 'schema='
      CommandLine|contains:
          - 'name='
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse