CVE-2026-116327
Received Received - Intake

Exposure of Sensitive Information in PostgreSQL via Security Barrier

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: PostgreSQL

Description
Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-116327
EUVD
EUVD-2026-124506

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.7 (exc)
postgresql postgresql to 17.12 (exc)
postgresql postgresql to 16.16 (exc)
postgresql postgresql to 15.20 (exc)
postgresql postgresql to 14.25 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves PostgreSQL's security_barrier feature, which is meant to protect sensitive data in views. An attacker can bypass this protection by using indirect expressions like leaky functions on CASE test values or internal parameters that represent protected columns. This allows them to infer hidden values they shouldn't access.

Detection Guidance

Detecting this vulnerability requires checking PostgreSQL version and reviewing database configurations for security_barrier usage. Use commands like 'psql --version' to check version and 'SELECT version();' to confirm. Review views with security_barrier for potential indirect expressions that could leak data.

Impact Analysis

If you use PostgreSQL with security_barrier views, an attacker with database access could exploit this flaw to read sensitive information they are not authorized to see. This could lead to data breaches, unauthorized data exposure, or compliance violations depending on the data involved.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate regulations like GDPR (data protection) or HIPAA (health information privacy). Organizations using affected PostgreSQL versions must update to mitigate risks of non-compliance and potential legal consequences.

Mitigation Strategies

Immediately update PostgreSQL to a patched version (18.7, 17.12, 16.16, 15.20, or 14.25 or later). Review and remove any security_barrier views using leaky functions or indirect expressions. Restrict database user permissions to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...