Row-Level Security Flaw in PostgreSQL by PostgreSQL Global Development Group

CVE-2026-14666

What is CVE-2026-14666?

This vulnerability arises from insufficient tracking in PostgreSQL of changes made to role memberships, attributes, and database ownership. As a result, queries may continue to operate with outdated row-level security policies even after changes demand a different policy due to caching. This allows some users the ability to perform reads and modifications that were recently permitted but are now prohibited. Attackers need to exploit this flaw by tailoring their methods to specific applications that rely on privilege adjustments and role-based row security policies. Notably, any session using a cached query can be compromised until an event occurs that invalidates the cache or the connection is terminated.

References