CVE-2026-116306 PostgreSQL composite-type change during field assignment executes arbitrary code

Red Hat Product Security rates this vulnerability as an Important severity issue because authenticated clients granted schema modification rights can escalate access to execute arbitrary commands under the operating system account managing PostgreSQL, resulting in a full compromise of database integrity and confidentiality. In standard Red Hat Enterprise Linux deployments, the database daemon operates under a dedicated, unprivileged system user (`postgres`), which confines the blast radius to database files and local service assets rather than full root access. Triggering the flaw requires the ability to construct and manipulate composite types within an active session, preventing unauthenticated external actors or read-only accounts from exploiting the issue.

Restrict network access to the PostgreSQL service to trusted hosts and revoke schema creation permissions from untrusted database accounts.

1. Restrict PostgreSQL network exposure using firewalld to only authorized subnets:

```

firewall-cmd --permanent --remove-service=postgresql

firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>

firewall-cmd --permanent --zone=trusted --add-service=postgresql

firewall-cmd --reload

```

2. Restrict object creation privileges within the database:

```

REVOKE CREATE ON SCHEMA <schema_name> FROM <username>;

```

Caveats:

Restricting network connectivity mitigates untrusted external exposure but does not prevent exploitation from authorized systems or accounts. Revoking schema creation privileges may break application workflows that require creating custom or temporary data types.

Warning: Executing `firewall-cmd --reload` modifies active firewall rules and may temporarily interrupt active database connections.