CVE-2026-116330 PostgreSQL pg_dump tar restore.sql fails to block psql command injection

This vulnerability is rated as Important severity for Red Hat because a compromised database server can achieve arbitrary code execution on client systems performing backups, directly impacting the integrity and confidentiality of the host environment. Under standard Red Hat Enterprise Linux configurations, database administrators typically interact with trusted internal databases and pg_dump produces plain-text backups by default rather than tar archives. However, if an administrator uses the optional tar format against an untrusted origin, executing the resulting restore script allows an attacker to run commands with the full privileges of the invoking operating system account.

Operational controls to mitigate this vulnerability include:

1. Avoid generating tar-format archives from untrusted database instances. By default, `pg_dump` outputs plain-text SQL. If binary or compressed archive formats are required, use the custom format (`-F c`) or directory format (`-F d`) instead of the tar format (`-F t` or `--format=tar`):

pg_dump -F c -d <database_name> -f <backup_file>.dump

2. Do not execute the embedded `restore.sql` script directly using `psql`. Instead, restore custom-format archives using `pg_restore`:

pg_restore -d <database_name> <backup_file>.dump

3. Restrict backup routines to verified, trusted PostgreSQL servers and ensure client commands are executed under a dedicated, unprivileged operating system service account.

Caveats: Automation pipelines or scripts requiring tar-formatted archives (`-F t`) or manual execution of `restore.sql` must be adjusted to use alternative dump formats or `pg_restore`. These adjustments affect client command-line utilities and do not require restarting database services.