CVE-2026-18447
Description
A flaw was found in PostgreSQL. An authenticated database user with privileges to create database objects can trigger a type confusion flaw by defining a SQL-language function with an output parameter of type "any". This vulnerability allows the user to execute arbitrary code with the permissions of the operating system user running the database service.
Statement
Red Hat rates this vulnerability as Important because an authenticated user with schema object creation privileges can escape the database engine and execute arbitrary system commands under the postgres host account. Although this issue allows compromise of the database host, exploitation requires valid database credentials and authorization to define custom functions, preventing unauthenticated remote attackers from triggering it directly. In standard Red Hat Enterprise Linux environments, untrusted database accounts are typically restricted from defining schema objects, limiting the attack surface.
Mitigation
1. Revoke CREATE privileges on public and user schemas from untrusted database roles to prevent unauthorized function creation:
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE CREATE ON SCHEMA <schema_name> FROM <role_name>;
2. Restrict network access to the PostgreSQL service to trusted management networks or hosts using firewalld:
firewall-cmd --permanent --remove-service=postgresql
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" service name="postgresql" accept'
firewall-cmd --reload
3. Restrict database client access in /var/lib/pgsql/data/pg_hba.conf to trusted IP addresses only, then reload the database configuration:
systemctl reload postgresql
Caveats:
Revoking schema creation privileges prevents affected database users from creating or altering functions, tables, or other objects, which may disrupt applications that rely on dynamic object definitions. Restricting network access or filtering client subnets prevents connections from unlisted hosts.
Warning:
Applying firewall changes or configuration changes requires reloading the firewall (`firewall-cmd --reload`) or the PostgreSQL service (`systemctl reload postgresql`), which may briefly disrupt active network connections or client sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties.
Availability,Integrity,Confidentiality
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
If a memory buffer is accessed using an incompatible type, and the allocated buffer is smaller than the type that the code is attempting to access, then an attacker could read or write memory outside the bounds of the buffer, leading to a crash or possibly code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
