CVE-2026-116330
Description
A flaw was found in PostgreSQL. When backing up a database using the pg_dump utility with tar-format archives, the generated restore script uses a predictable restriction key. A compromised or malicious database server can exploit this flaw by injecting untrusted data, leading to arbitrary code execution with the operating system privileges of the client account running the restore command.
Statement
This vulnerability is rated as Important severity for Red Hat because a compromised database server can achieve arbitrary code execution on client systems performing backups, directly impacting the integrity and confidentiality of the host environment. Under standard Red Hat Enterprise Linux configurations, database administrators typically interact with trusted internal databases and pg_dump produces plain-text backups by default rather than tar archives. However, if an administrator uses the optional tar format against an untrusted origin, executing the resulting restore script allows an attacker to run commands with the full privileges of the invoking operating system account.
Mitigation
Operational controls to mitigate this vulnerability include:
1. Avoid generating tar-format archives from untrusted database instances. By default, `pg_dump` outputs plain-text SQL. If binary or compressed archive formats are required, use the custom format (`-F c`) or directory format (`-F d`) instead of the tar format (`-F t` or `--format=tar`):
pg_dump -F c -d <database_name> -f <backup_file>.dump
2. Do not execute the embedded `restore.sql` script directly using `psql`. Instead, restore custom-format archives using `pg_restore`:
pg_restore -d <database_name> <backup_file>.dump
3. Restrict backup routines to verified, trusted PostgreSQL servers and ensure client commands are executed under a dedicated, unprivileged operating system service account.
Caveats: Automation pipelines or scripts requiring tar-formatted archives (`-F t`) or manual execution of `restore.sql` must be adjusted to use alternative dump formats or `pg_restore`. These adjustments affect client command-line utilities and do not require restarting database services.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Injected code can access resources that the attacker is directly prevented from accessing.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
When a product allows a user's input to contain code syntax, it might be possible for an attacker to craft the code in such a way that it will alter the intended control flow of the product. As a result, code injection can often result in the execution of arbitrary code. Code injection attacks can also lead to loss of data integrity in nearly all cases, since the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation
Technical Impact: Hide Activities
Often the actions performed by injected control code are unlogged.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
