CVE-2026-120148 PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code

This vulnerability is rated as Important because an authenticated user with permissions to create database objects can escalate privileges to execute code in the context of the underlying postgres operating system service account. The requirement for valid authentication credentials and object creation rights prevents this from being a Critical issue, as it cannot be triggered by unauthenticated network callers. However, in shared database environments where multiple users or applications possess schema creation privileges, an attacker can break tenant isolation and achieve full access to host database assets.

Restrict exposure by limiting network reachability to the PostgreSQL service and removing object creation privileges from untrusted database accounts.

1. Restrict PostgreSQL network access to trusted hosts using firewalld:

# firewall-cmd --permanent --remove-service=postgresql

# firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>

# firewall-cmd --reload

2. Alternatively, configure PostgreSQL to bind only to local or trusted internal network interfaces in postgresql.conf:

listen_addresses = 'localhost, <trusted_internal_ip>'

Apply configuration changes by reloading the service:

# systemctl reload postgresql

3. Restrict database privileges so that untrusted database users cannot create objects or custom statistics:

REVOKE CREATE ON SCHEMA public FROM PUBLIC;

Caveats:

Restricting network connectivity blocks database access from unlisted client systems. Revoking schema creation privileges prevents non-administrative database users from creating tables or statistics, which may disrupt applications that rely on dynamic schema modification.

Warning:

Reloading firewalld or the PostgreSQL service immediately alters network packet filtering and re-reads database daemon configurations. Ensure changes are verified in staging environments before applying them in production.