CVE-2026-116335 PostgreSQL commutator or negator result-type confusion executes arbitrary code

This flaw is rated as Important severity rather than Critical because exploitation requires valid database credentials with schema-creation privileges, although arbitrary code execution under the database daemon presents a severe host and data risk. In standard Red Hat Enterprise Linux environments, the database server runs under a dedicated service account, but successful exploitation permits full compromise of all managed databases and local files accessible to the service. Deployments are primarily exposed when untrusted accounts possess permissions to define custom database objects.

Restrict access to the PostgreSQL service to trusted hosts and revoke schema creation privileges from untrusted database users.

1. Restrict PostgreSQL network reachability using firewalld:

firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>

firewall-cmd --permanent --remove-service=postgresql

firewall-cmd --reload

Alternatively, restrict client addresses in pg_hba.conf and reload the service:

systemctl reload postgresql

2. Revoke object creation permissions on database schemas to prevent unprivileged users from defining operators:

REVOKE CREATE ON SCHEMA public FROM PUBLIC;

Caveats: Revoking schema creation privileges prevents non-administrative database users from defining new objects, which may break applications that create custom or temporary entities. Restricting network access prevents external connections from non-allowlisted systems.

Warning: Reloading firewall rules or reloading the PostgreSQL service via `systemctl reload postgresql` applies configuration changes immediately. Ensure that changes to pg_hba.conf are validated prior to reloading to avoid service disruptions.