CVE Detection for Database Extensions

The cve detection policy reports database extensions with known vulnerabilities, checked against the Atlas Security Graph.

Database extensions ship their own code and their own vulnerabilities, and the version that is installed is rarely the one anybody looks at during review. The new cve analyzer resolves the extensions in a schema against the Atlas Security Graph and reports the CVEs published for them, with the severity and the remediation the graph records.

Enabling the Analyzer

Add a cve block to the lint config in your atlas.hcl. With no attributes, every reported vulnerability is included as a warning:

env "local" {
  url = "postgres://postgres:pass@localhost:5432/app?sslmode=disable"
  dev = "docker://postgres/18/dev"
  migration {
    dir = "file://migrations"
  }
  lint {
    cve {}
  }
}

Linting a Migration Directory

In atlas migrate lint, the analyzer reports the extensions the analyzed files install or update, and attributes each diagnostic to the statement that left the extension in that version. Extensions the file drops are not reported, as they are not installed after it runs:

atlas migrate lint --env local --latest 1

Analyzing changes until version 1 (1 migration in total):

  -- analyzing version 1
    -- vulnerable extensions detected:
      -- L1: Extension "pgcrypto" version "1.3" is vulnerable to CVE-2026-2005 (HIGH):
         PostgreSQL pgcrypto heap buffer overflow executes arbitrary code. Upgrade the
         database engine to version 14.21 or later to resolve CVE-2026-2005: the fix for
         extension "pgcrypto" ships in engine releases
  -- ok (1.099042708s)

  -------------------------
  -- 1.196670417s
  -- 1 version with warnings
  -- 1 schema change
  -- 1 diagnostic

Linting a Schema

In atlas schema lint, every extension in the schema is reported, not only the ones a change touches, because new CVEs are published for versions that are already installed:

atlas schema lint --env local --url env://url

Analyzing schema objects (5 objects in total):

  vulnerable extensions detected:
    -- Extension "intarray" version "1.2" is vulnerable to CVE-2026-2004 (HIGH): PostgreSQL
       intarray missing validation of type of input to selectivity estimator executes arbitrary
       code. Upgrade the database engine to version 14.21 or later to resolve CVE-2026-2004: the
       fix for extension "intarray" ships in engine releases
    -- Extension "pgcrypto" version "1.3" is vulnerable to CVE-2026-2005 (HIGH): PostgreSQL
       pgcrypto heap buffer overflow executes arbitrary code. Upgrade the database engine to
       version 14.21 or later to resolve CVE-2026-2005: the fix for extension "pgcrypto" ships in
       engine releases

  -------------------------
  -- 1.099249667s
  -- 2 diagnostics

Filtering What Gets Reported

The block takes four optional attributes, so a pipeline can fail on the vulnerabilities it cares about and stay quiet on the rest:

lint {
  cve {
    min_severity = HIGH
    ignore       = ["CVE-2024-10977"]
    error        = true
  }
}

Findings are matched against the installed extension version and the version of the dev database, so built-in extensions, whose fixes ship in engine releases rather than in the extension itself, are reported against the engine you run.

See the Vulnerable Extensions documentation for the full reference, and Migration Analyzers for the other policies that run in the same block.