CVE-2026-120141 PostgreSQL materialized set-returning function type confusion executes arbitrary code

This vulnerability is rated as Important severity because an authenticated database user can achieve arbitrary code execution under the privileges of the operating system account running the PostgreSQL service. While exploiting the issue requires valid database credentials, it allows standard database users without superuser privileges to breach host boundaries and compromise the underlying operating system process. In Red Hat Enterprise Linux environments where databases serve multiple applications or untrusted tenants, this enables direct escalation from database access to local host compromise.

Restrict network access to the PostgreSQL service so that only trusted client IP addresses can establish connections, and avoid provisioning database accounts to untrusted users.

1. Using firewalld, restrict PostgreSQL access (default port 5432/tcp) to trusted IP addresses or subnets:

```sh

firewall-cmd --permanent --remove-service=postgresql

firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_range>

firewall-cmd --reload

```

2. Alternatively, restrict client connection access in `/var/lib/pgsql/data/pg_hba.conf` to specific trusted addresses, then reload the service:

```sh

systemctl reload postgresql

```

Caveats:

Restricting network access limits exposure from untrusted networks, but any authenticated database user connecting from an authorized host can still trigger the vulnerability.

Warning: Reloading firewall configuration or the PostgreSQL service may momentarily interrupt active network connections. Verify that administrative management sources are included in trusted rules prior to reloading to avoid losing remote access.