CVE-2026-116331 PostgreSQL min/max aggregate type confusion executes arbitrary code

This vulnerability is rated as having an Important severity for Red Hat deployments because, although successful exploitation leads to complete arbitrary code execution under the operating system account running the database service, it requires an authenticated attacker with permissions to define custom database objects rather than being exploitable by unauthenticated remote users. In typical enterprise environments, database access is restricted and standard application roles do not possess schema creation privileges, which limits the attack surface to trusted or privileged database accounts. However, in shared hosting or multi-tenant configurations where non-administrative users can create schemas and custom routines, an attacker could leverage this flaw to fully compromise the database host.

Revoke object creation permissions from untrusted database accounts and restrict network access to trusted administrative hosts.

1. Revoke schema creation permissions to prevent users from defining custom aggregates:

```sql

REVOKE CREATE ON SCHEMA public FROM PUBLIC;

REVOKE CREATE ON SCHEMA <schema_name> FROM <username>;

```

2. Limit network access to trusted clients using firewalld:

```bash

firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>

firewall-cmd --permanent --zone=public --remove-service=postgresql

firewall-cmd --reload

```

Alternatively, restrict client access rules in `/var/lib/pgsql/data/pg_hba.conf` and apply the configuration:

```bash

systemctl reload postgresql

```

Caveats: Revoking object creation privileges prevents non-administrative users and applications from creating or modifying custom database objects and schemas. Limiting network access will block queries from unlisted client hosts.

Warning: Modifying firewall rules or reloading the PostgreSQL service (`systemctl reload postgresql`) affects service accessibility. Ensure configuration changes are applied during scheduled maintenance windows to prevent unexpected disruption to active sessions.