TI-2026-12361 Aliases CVE-2026-14666 GHSA-fvh5-w7wg-xp3g

PostgreSQL row security caching disregards role modifications

LOW 19CWE-1250Published 2026-08-13 · Updated 2026-08-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00209 11th percentileScored 2026-11-07

Fix Partial PostgreSQL: 18.6, 17.11, 16.15 +2Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	PostgreSQL	18 to before 18.6; 17 to before 17.11; 16 to before 16.15; 15 to before 15.19; before 14.24	18.6, 17.11, 16.15, 15.19, 14.24	Patch available	CNA

PostgreSQL Vendor— Affected 18 to before 18.6; 17 to before 17.11; 16 to before 16.15; 15 to before 15.19; before 14.24 Fixed in 18.6, 17.11, 16.15, 15.19, 14.24 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:postgresql:postgresql::::::::	14.0 to before 14.24; 15.0 to before 15.19; 16.0 to before 16.15; 17.0 to before 17.11; 18.0 to before 18.5	Vulnerable	PostgreSQL

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 14.0 to before 14.24; 15.0 to before 15.19; 16.0 to before 16.15; 17.0 to before 17.11; 18.0 to before 18.5 Vulnerable ·PostgreSQL

Remediation

Fix · CNA PostgreSQL Fixed in 18.6, 17.11, 16.15, 15.19, 14.24

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-13
PostgreSQL 14.24, 15.19 and 3 more versions
23 records Highest priority Priority MEDIUM 12 MEDIUM, 11 LOW
Other records, highest priority first
- TI-2026-13579 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codePriority MEDIUM 41
- TI-2026-13244 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparoundPriority MEDIUM 41
- TI-2026-12363 PostgreSQL to_char heap buffer overflow executes arbitrary codePriority MEDIUM 41
Show all 23 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Self-service automation portal 2	Affected	No fix yet: Fix deferred

Not affected: 3 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Hardened Images

Timeline

2026-10-02 Threatist record created from CVE-2026-14666
2026-10-03 Alias added: GHSA-fvh5-w7wg-xp3g

References

Advisory 1

https://www.postgresql.org/support/security/CVE-2026-14666/

TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8

See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences