GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-14666 (GCVE-0-2026-14666)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07
VLAI
Title
PostgreSQL row security caching disregards role modifications
Summary
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:53 UTC
CWE
  • CWE-1250 - Improper Preservation of Consistency Between Independent Representations of Shared State
Assigner
References
Impacted products
Vendor Product Version CPE status
n/a PostgreSQL Affected: 18 , < 18.6 (rpm)
Affected: 17 , < 17.11 (rpm)
Affected: 16 , < 16.15 (rpm)
Affected: 15 , < 15.19 (rpm)
Affected: 0 , < 14.24 (rpm)
Credits
The PostgreSQL project thanks Staroverov Ilja and Shinya Kato for reporting this problem.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T14:53:54.547151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:34:56.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "application uses row security policies that react to the current role, and application modifies roles to change the applicable policies"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Staroverov Ilja and Shinya Kato for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse.  Stale policies continue until some other event invalidates the cache or connection termination ends the session.  This permits a user to complete reads and modifications that were recently permitted but now forbidden.  An attacker must tailor an attack to a particular application\u0027s pattern of privilege removal and role-specific row security policies.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1250",
              "description": "Improper Preservation of Consistency Between Independent Representations of Shared State",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:13.583Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14666/"
        }
      ],
      "title": "PostgreSQL row security caching disregards role modifications",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14666",
    "datePublished": "2026-08-13T13:00:03.720Z",
    "dateReserved": "2026-07-03T20:28:10.229Z",
    "dateUpdated": "2026-08-29T23:07:13.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-14666",
      "date": "2026-09-18",
      "epss": "0.00175",
      "percentile": "0.07329"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T15:02:11.000Z",
      "cve": "CVE-2026-14666",
      "id": "msrc_CVE-2026-14666",
      "initial_release_date": "2026-08-14T19:29:43.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "PostgreSQL row security caching disregards role modifications",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-14666.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "PostgreSQL",
                "vendor": "n/a",
                "versions": [
                  {
                    "lessThan": "18.6",
                    "status": "affected",
                    "version": "18",
                    "versionType": "rpm"
                  },
                  {
                    "lessThan": "17.11",
                    "status": "affected",
                    "version": "17",
                    "versionType": "rpm"
                  },
                  {
                    "lessThan": "16.15",
                    "status": "affected",
                    "version": "16",
                    "versionType": "rpm"
                  },
                  {
                    "lessThan": "15.19",
                    "status": "affected",
                    "version": "15",
                    "versionType": "rpm"
                  },
                  {
                    "lessThan": "14.24",
                    "status": "affected",
                    "version": "0",
                    "versionType": "rpm"
                  }
                ]
              }
            ],
            "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6BEE5714-C2EF-48DC-8613-C3EAA149E12E",
                    "versionEndExcluding": "14.24",
                    "versionStartIncluding": "14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F433746A-733F-4ED0-9913-8AF69E0C8BF2",
                    "versionEndExcluding": "15.19",
                    "versionStartIncluding": "15.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1996B91F-E0B2-4A78-8788-E17EA68D179C",
                    "versionEndExcluding": "16.15",
                    "versionStartIncluding": "16.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3D04E642-71D7-4979-AA19-B9CCDEFD8C31",
                    "versionEndExcluding": "17.11",
                    "versionStartIncluding": "17.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8494F67B-673A-4E1F-8F40-D24DCC1F8DA4",
                    "versionEndExcluding": "18.5",
                    "versionStartIncluding": "18.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse.  Stale policies continue until some other event invalidates the cache or connection termination ends the session.  This permits a user to complete reads and modifications that were recently permitted but now forbidden.  An attacker must tailor an attack to a particular application\u0027s pattern of privilege removal and role-specific row security policies.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
          }
        ],
        "id": "CVE-2026-14666",
        "lastModified": "2026-08-29T23:17:12.400",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 2.5,
              "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-14666",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T14:53:54.547151Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T13:17:43.993",
        "references": [
          {
            "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.postgresql.org/support/security/CVE-2026-14666/"
          }
        ],
        "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1250"
              }
            ],
            "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-03T09:02:28+00:00",
      "cve": "CVE-2026-14666",
      "id": "CVE-2026-14666",
      "initial_release_date": "2026-08-13T13:00:03.720000+00:00",
      "product_status:known_affected": "162",
      "product_status:known_not_affected": "27",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "postgresql: PostgreSQL: Row security caching disregards role modifications leading to unauthorized data access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-14666.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T01:00:24Z",
      "cve": "CVE-2026-14666",
      "id": "CVE-2026-14666",
      "initial_release_date": "2026-08-15T00:00:02Z",
      "product_status:known_affected": "144",
      "product_status:known_not_affected": "360",
      "product_status:recommended": "1014",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-14666",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-14666.json",
      "version": "13"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-14666",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:53:54.547151Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T15:34:50.760Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "PostgreSQL",
              "vendor": "n/a",
              "versions": [
                {
                  "lessThan": "18.6",
                  "status": "affected",
                  "version": "18",
                  "versionType": "rpm"
                },
                {
                  "lessThan": "17.11",
                  "status": "affected",
                  "version": "17",
                  "versionType": "rpm"
                },
                {
                  "lessThan": "16.15",
                  "status": "affected",
                  "version": "16",
                  "versionType": "rpm"
                },
                {
                  "lessThan": "15.19",
                  "status": "affected",
                  "version": "15",
                  "versionType": "rpm"
                },
                {
                  "lessThan": "14.24",
                  "status": "affected",
                  "version": "0",
                  "versionType": "rpm"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "value": "application uses row security policies that react to the current role, and application modifies roles to change the applicable policies"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "The PostgreSQL project thanks Staroverov Ilja and Shinya Kato for reporting this problem."
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse.  Stale policies continue until some other event invalidates the cache or connection termination ends the session.  This permits a user to complete reads and modifications that were recently permitted but now forbidden.  An attacker must tailor an attack to a particular application\u0027s pattern of privilege removal and role-specific row security policies.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1250",
                  "description": "Improper Preservation of Consistency Between Independent Representations of Shared State",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-29T23:07:13.583Z",
            "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
            "shortName": "PostgreSQL"
          },
          "references": [
            {
              "url": "https://www.postgresql.org/support/security/CVE-2026-14666/"
            }
          ],
          "title": "PostgreSQL row security caching disregards role modifications",
          "x_postgresql": {
            "component": "core server"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "assignerShortName": "PostgreSQL",
        "cveId": "CVE-2026-14666",
        "datePublished": "2026-08-13T13:00:03.720Z",
        "dateReserved": "2026-07-03T20:28:10.229Z",
        "dateUpdated": "2026-08-29T23:07:13.583Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.