CVE-2026-120148
Description
A flaw was found in PostgreSQL. A type confusion vulnerability in the extended statistics component allows an authenticated database user with object creation permissions to execute arbitrary code as the operating system user running the database. By defining an extended statistics expression with an anonymous record type, an attacker can cause data types to be misinterpreted across database sessions, leading to memory corruption.
Statement
This vulnerability is rated as Important because an authenticated user with permissions to create database objects can escalate privileges to execute code in the context of the underlying postgres operating system service account. The requirement for valid authentication credentials and object creation rights prevents this from being a Critical issue, as it cannot be triggered by unauthenticated network callers. However, in shared database environments where multiple users or applications possess schema creation privileges, an attacker can break tenant isolation and achieve full access to host database assets.
Mitigation
Restrict exposure by limiting network reachability to the PostgreSQL service and removing object creation privileges from untrusted database accounts.
1. Restrict PostgreSQL network access to trusted hosts using firewalld:
# firewall-cmd --permanent --remove-service=postgresql
# firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>
# firewall-cmd --reload
2. Alternatively, configure PostgreSQL to bind only to local or trusted internal network interfaces in postgresql.conf:
listen_addresses = 'localhost, <trusted_internal_ip>'
Apply configuration changes by reloading the service:
# systemctl reload postgresql
3. Restrict database privileges so that untrusted database users cannot create objects or custom statistics:
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
Caveats:
Restricting network connectivity blocks database access from unlisted client systems. Revoking schema creation privileges prevents non-administrative database users from creating tables or statistics, which may disrupt applications that rely on dynamic schema modification.
Warning:
Reloading firewalld or the PostgreSQL service immediately alters network packet filtering and re-reads database daemon configurations. Ensure changes are verified in staging environments before applying them in production.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties.
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
