CVE-2026-14666
Received Received - Intake

PostgreSQL Role Membership Policy Bypass via Cached Policies

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-14666
EUVD
EUVD-2026-57834

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 18.5|end_excluding=17.11|end_excluding=16.15|end_excluding=15.19|end_excluding=14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1250 The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PostgreSQL involves incomplete tracking of changes to role membership, role attributes, and database ownership. It allows queries to reuse cached row-level security policies even after these changes should invalidate them. This means users can perform actions that were previously allowed but are now forbidden due to privilege changes. The issue persists until the cache is cleared or the session ends.

Detection Guidance

Detecting this vulnerability requires checking PostgreSQL versions and reviewing row-level security policies. Use 'SELECT version();' to verify if your PostgreSQL version is below 18.5, 17.11, 16.15, 15.19, or 14.24. Inspect active row security policies with 'SELECT * FROM pg_policies;' and check for stale cached policies by monitoring query plans with 'EXPLAIN (ANALYZE, VERBOSE) your_query;' to identify reused policies after privilege changes.

Impact Analysis

An attacker could exploit this by tailoring attacks to an application's specific privilege removal patterns. This could allow unauthorized reads or modifications of data that should no longer be accessible due to recent privilege changes. The impact depends on the application's security policies and how privileges are managed.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating compliance requirements for data protection standards like GDPR or HIPAA. Unauthorized reads or modifications of sensitive data may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade PostgreSQL to a patched version (18.5 or later, 17.11, 16.15, 15.19, or 14.24). Restart affected PostgreSQL services to clear cached policies. Review and update row security policies to ensure they reflect current role membership and privileges. Monitor database sessions for unusual activity post-upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart