CVE-2026-116335
Description
A flaw was found in PostgreSQL. An authenticated database user with permissions to create database objects can trigger a type confusion issue by creating operator commutator or negator links with mismatched result types or inconsistent reciprocal links. Successful exploitation allows an attacker to execute arbitrary code on the host system with the privileges of the operating system user running the database server.
Statement
This flaw is rated as Important severity rather than Critical because exploitation requires valid database credentials with schema-creation privileges, although arbitrary code execution under the database daemon presents a severe host and data risk. In standard Red Hat Enterprise Linux environments, the database server runs under a dedicated service account, but successful exploitation permits full compromise of all managed databases and local files accessible to the service. Deployments are primarily exposed when untrusted accounts possess permissions to define custom database objects.
Mitigation
Restrict access to the PostgreSQL service to trusted hosts and revoke schema creation privileges from untrusted database users.
1. Restrict PostgreSQL network reachability using firewalld:
firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>
firewall-cmd --permanent --remove-service=postgresql
firewall-cmd --reload
Alternatively, restrict client addresses in pg_hba.conf and reload the service:
systemctl reload postgresql
2. Revoke object creation permissions on database schemas to prevent unprivileged users from defining operators:
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
Caveats: Revoking schema creation privileges prevents non-administrative database users from defining new objects, which may break applications that create custom or temporary entities. Restricting network access prevents external connections from non-allowlisted systems.
Warning: Reloading firewall rules or reloading the PostgreSQL service via `systemctl reload postgresql` applies configuration changes immediately. Ensure that changes to pg_hba.conf are validated prior to reloading to avoid service disruptions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties.
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
