PostgreSQL RLS Policy Cache Stale After Role Changes (<18.5/17.11/16.15)
CVE-2026-14666 Published on August 13, 2026
PostgreSQL row security caching disregards role modifications
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Weakness Type
Improper Preservation of Consistency Between Independent Representations of Shared State
The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
Products Associated with CVE-2026-14666
stack.watch emails you whenever new vulnerabilities are published in PostgreSQL or Canonical Ubuntu Linux. Just hit a watch button to start following.
