CVE-2026-120143
Description
A flaw was found in PostgreSQL. A use-after-free vulnerability in trigger functions allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database. By defining a cursor over a transition table within a trigger function, an attacker can access previously freed memory, resulting in memory corruption and full compromise of the database service process.
Statement
This vulnerability is rated as Important severity because an authenticated database user with permissions to create database objects can achieve arbitrary code execution under the privileges of the postgres operating system account. Although exploiting the flaw requires network access and schema manipulation rights, the resulting use-after-free condition breaks database boundaries and compromises the host service process. Multi-tenant database deployments that grant object creation rights to untrusted roles face the highest risk.
Mitigation
1. Summary of action:
Restrict PostgreSQL network access to trusted management networks and revoke object creation privileges from untrusted database users.
2. Configuration and command examples:
Limit incoming traffic to the PostgreSQL service port (TCP 5432) to trusted hosts or subnets using firewalld:
# firewall-cmd --permanent --remove-service=postgresql
# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" port port="5432" protocol="tcp" accept'
# firewall-cmd --reload
Within PostgreSQL, remove schema creation rights from unprivileged accounts:
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
Additionally, restrict allowed client addresses in pg_hba.conf to trusted hosts only.
3. Caveats:
Restricting network access will block database connections from unauthorized or unlisted client IP addresses. Revoking CREATE privileges prevents non-administrative users from creating new tables, views, or triggers.
4. Warning:
Applying firewall modifications requires reloading firewalld, which applies network policy changes immediately. Modifying pg_hba.conf requires a service reload (such as 'systemctl reload postgresql') for changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
