Loading vulnerability…
PostgreSQL Row-Level Security Bypass Through Stale Cached Policies
CVE-2026-14666 is an authorization vulnerability in PostgreSQL's row-level security policy caching. Incomplete tracking of changes to role membership, role attributes, and database ownership allows reused query plans to retain policies that no longer reflect the user's authorization. A user can consequently continue reading or modifying rows after those operations become forbidden. Stale policies remain effective until another event invalidates the cache or the database session terminates. Affected releases are PostgreSQL 18 before 18.6, 17 before 17.11, 16 before 16.15, 15 before 15.19, and 14 before 14.24.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses newly applicable row-level security restrictions, compromising the confidentiality and integrity of affected rows. Users may retain previously authorized read and modification capabilities after relevant role or ownership changes. The scope depends on the application's policies and privilege-removal behavior; no availability impact is identified.
If you can’t patch tonight, do this now.
Until patched, terminate affected database sessions after role membership, role attribute, or database ownership changes that tighten row-level access restrictions. Ensure connection pools also close affected backend sessions rather than merely returning connections to the pool. Session termination removes the stale session-local cached policies; this is an interim measure, not a replacement for updating.
Patch, then assume compromise.
Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later in the applicable major-version branch, or install the corresponding vendor security-fixed packages. Restart PostgreSQL as required by the package update instructions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.