Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-11-12T14:15:17 postgresql: postgresql: Arbitrary code execution via aggregate optimization type confusion 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-843

Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A flaw was found in PostgreSQL. An authenticated user with permission to create database objects can exploit this vulnerability to achieve arbitrary code execution as the operating system user running the database service. The issue occurs during query optimization when a user-defined aggregate function specifies a sort operator (SORTOP) that causes the query planner to treat different data types as identical. This data type confusion allows an attacker to manipulate internal memory and compromise the host system.

This vulnerability is rated as having an Important severity for Red Hat deployments because, although successful exploitation leads to complete arbitrary code execution under the operating system account running the database service, it requires an authenticated attacker with permissions to define custom database objects rather than being exploitable by unauthenticated remote users. In typical enterprise environments, database access is restricted and standard application roles do not possess schema creation privileges, which limits the attack surface to trusted or privileged database accounts. However, in shared hosting or multi-tenant configurations where non-administrative users can create schemas and custom routines, an attacker could leverage this flaw to fully compromise the database host. Revoke object creation permissions from untrusted database accounts and restrict network access to trusted administrative hosts. 1. Revoke schema creation permissions to prevent users from defining custom aggregates: ```sql REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE CREATE ON SCHEMA <schema_name> FROM <username>; ``` 2. Limit network access to trusted clients using firewalld: ```bash firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet> firewall-cmd --permanent --zone=public --remove-service=postgresql firewall-cmd --reload ``` Alternatively, restrict client access rules in `/var/lib/pgsql/data/pg_hba.conf` and apply the configuration: ```bash systemctl reload postgresql ``` Caveats: Revoking object creation privileges prevents non-administrative users and applications from creating or modifying custom database objects and schemas. Limiting network access will block queries from unlisted client hosts. Warning: Modifying firewall rules or reloading the PostgreSQL service (`systemctl reload postgresql`) affects service accessibility. Ensure configuration changes are applied during scheduled maintenance windows to prevent unexpected disruption to active sessions. Red Hat Hardened Images 2026-11-13T00:00:00Z RHSA-2026:100114 postgresql17-main-17.12-0.1.hum1 Red Hat Hardened Images 2026-11-13T00:00:00Z RHSA-2026:100123 postgresql18-main-18.7-0.1.hum1 Red Hat Hardened Images 2026-11-12T00:00:00Z RHSA-2026:99821 libpq-main-18.7-0.1.hum1 https://www.cve.org/CVERecord?id=CVE-2026-116331 https://nvd.nist.gov/vuln/detail/CVE-2026-116331 https://www.postgresql.org/support/security/CVE-2026-116331/