CVE-2026-18447 PostgreSQL output parameter type confusion executes arbitrary code

Red Hat rates this vulnerability as Important because an authenticated user with schema object creation privileges can escape the database engine and execute arbitrary system commands under the postgres host account. Although this issue allows compromise of the database host, exploitation requires valid database credentials and authorization to define custom functions, preventing unauthenticated remote attackers from triggering it directly. In standard Red Hat Enterprise Linux environments, untrusted database accounts are typically restricted from defining schema objects, limiting the attack surface.

1. Revoke CREATE privileges on public and user schemas from untrusted database roles to prevent unauthorized function creation:

REVOKE CREATE ON SCHEMA public FROM PUBLIC;

REVOKE CREATE ON SCHEMA <schema_name> FROM <role_name>;

2. Restrict network access to the PostgreSQL service to trusted management networks or hosts using firewalld:

firewall-cmd --permanent --remove-service=postgresql

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" service name="postgresql" accept'

firewall-cmd --reload

3. Restrict database client access in /var/lib/pgsql/data/pg_hba.conf to trusted IP addresses only, then reload the database configuration:

systemctl reload postgresql

Caveats:

Revoking schema creation privileges prevents affected database users from creating or altering functions, tables, or other objects, which may disrupt applications that rely on dynamic object definitions. Restricting network access or filtering client subnets prevents connections from unlisted hosts.

Warning:

Applying firewall changes or configuration changes requires reloading the firewall (`firewall-cmd --reload`) or the PostgreSQL service (`systemctl reload postgresql`), which may briefly disrupt active network connections or client sessions.