# Babelfish: two TDS flaws require different access

Canonical: https://www.oktsec.com/radar/babelfish-tds-cve-2026-119923-119924
Publisher: Oktsec
Language: en
Published: 2026-11-07T12:52:55Z
Updated: 2026-11-07T12:52:55Z
Record reviewed: 2026-11-07T12:52:55Z
Latest evidence check: 2026-11-07T12:52:55Z
Disclosed: 2026-11-06

AWS confirms two TDS memory flaws: CVE-2026-119923 is reachable without authentication, while CVE-2026-119924 requires authentication.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: Only deployments with Babelfish enabled are in scope; the two CVEs have different authentication requirements.
- Evidence: Attacks not established
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: AWS
- Products: Babelfish for PostgreSQL, Babelfish for Aurora PostgreSQL
- CVEs: CVE-2026-119923, CVE-2026-119924

## Technical overview

The handshake flaw can affect database process confidentiality, integrity and availability. The authenticated RPC flaw can disclose adjacent memory or interrupt service.

Do not apply one extension version threshold to every Aurora branch. The bulletin does not establish active exploitation.

## Recommended response

Restrict TDS access. Match your engine and Babelfish versions to the AWS correction matrix before upgrading.

Relevant to: Babelfish operators.

## Affected systems and fixes

### Babelfish for PostgreSQL

Affected: Affected branches listed in AWS 2026-166.

Fixed release / action: 4.10; 5.6; 6.1

### Aurora PostgreSQL with Babelfish enabled

Affected: Match both engine and extension versions to AWS 2026-166.

Fixed release / action: Use the bulletin's branch matrix and apply pending maintenance.

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.04
Checked: 2026-11-05T12:14:16.442Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-07T13:37:50.242Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast


No score returned for: CVE-2026-119923, CVE-2026-119924

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-07T13:37:50.242Z.

## Response checklist

1. **Confirm Babelfish is enabled** — Record engine and extension versions.
2. **Apply the branch correction** — Restrict TDS, normally port 1433, to trusted sources while upgrading.

## Relevance to AI environments

Check databases used by agents if Babelfish is enabled.

## Sources

- [AWS 2026-166](https://aws.amazon.com/security/security-bulletins/2026-166-aws/) — AWS; Vendor notice; checked 2026-11-07T12:52:55Z

## Editorial record

- 2026-11-07T12:52:55Z: Added vendor scope, corrections and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/babelfish-tds-cve-2026-119923-119924) · [Build a response plan](https://www.oktsec.com/radar/babelfish-tds-cve-2026-119923-119924#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=babelfish-tds-cve-2026-119923-119924&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=babelfish-tds-cve-2026-119923-119924&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.