Missing Authorization in PostgreSQL - CVE-2026-14666

Vulnerability details

The vulnerability allows a remote user to bypass row-level security restrictions and access or modify data that should no longer be permitted.

The vulnerability exists due to incomplete tracking of role membership, role attribute, and database ownership changes in PostgreSQL row-level security policy caching when reusing query plans. A remote user can reuse a cached plan after privilege or role changes to bypass row-level security restrictions and access or modify data that should no longer be permitted.

Exploitation requires tailoring the attack to an application's pattern of privilege removal and role-specific row security policies, and stale policies persist until cache invalidation or session termination.

Affected software

How to mitigate CVE-2026-14666

External References

• https://www.postgresql.org/support/security/CVE-2026-14666/

Related Security Bulletins

• Multiple vulnerabilities in PostgreSQL
• Debian update for postgresql-17