CVE-2026-120151 PostgreSQL plpgsql record-field type confusion executes arbitrary code

This vulnerability is rated as Important because an authenticated database user with permission to create database objects can escalate privileges and achieve arbitrary code execution as the PostgreSQL operating system service account. Although exploitation requires existing network access and non-trivial database creation privileges—precluding unauthenticated attackers—the flaw circumvents standard database engine isolation to fully compromise database host integrity and confidentiality. Standard hardened Red Hat Enterprise Linux deployments that restrict database object creation to administrative accounts substantially limit exposure to this flaw.

Restrict network exposure of the PostgreSQL service to trusted client hosts and remove database object creation privileges from untrusted accounts:

1. Restrict client connections in `/var/lib/pgsql/data/pg_hba.conf` to authorized IP addresses only, then reload the database configuration:

```

systemctl reload postgresql

```

2. Revoke object creation permissions from untrusted database users on the public schema:

```

REVOKE CREATE ON SCHEMA public FROM PUBLIC;

```

Caveats: Restricting connection rules blocks access from unlisted clients. Revoking schema creation privileges prevents non-administrative users from defining custom tables, types, or PL/pgSQL functions, which may impact applications that perform dynamic schema changes.

Warning: Reloading the PostgreSQL service or modifying network filter rules applies changes immediately and can terminate or disrupt existing connections.