CVE-2026-120143 PostgreSQL transition-table cursor use-after-free executes arbitrary code

This vulnerability is rated as Important severity because an authenticated database user with permissions to create database objects can achieve arbitrary code execution under the privileges of the postgres operating system account. Although exploiting the flaw requires network access and schema manipulation rights, the resulting use-after-free condition breaks database boundaries and compromises the host service process. Multi-tenant database deployments that grant object creation rights to untrusted roles face the highest risk.

1. Summary of action:

Restrict PostgreSQL network access to trusted management networks and revoke object creation privileges from untrusted database users.

2. Configuration and command examples:

Limit incoming traffic to the PostgreSQL service port (TCP 5432) to trusted hosts or subnets using firewalld:

# firewall-cmd --permanent --remove-service=postgresql

# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" port port="5432" protocol="tcp" accept'

# firewall-cmd --reload

Within PostgreSQL, remove schema creation rights from unprivileged accounts:

REVOKE CREATE ON SCHEMA public FROM PUBLIC;

Additionally, restrict allowed client addresses in pg_hba.conf to trusted hosts only.

3. Caveats:

Restricting network access will block database connections from unauthorized or unlisted client IP addresses. Revoking CREATE privileges prevents non-administrative users from creating new tables, views, or triggers.

4. Warning:

Applying firewall modifications requires reloading firewalld, which applies network policy changes immediately. Modifying pg_hba.conf requires a service reload (such as 'systemctl reload postgresql') for changes to take effect.