Description

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-13T13:17:43.993Z",
  "pubdate": "2026-08-13T13:17:43.993Z",
  "executiveSummary": "PostgreSQL contains an incomplete tracking vulnerability regarding changes to role membership, role attributes, and database ownership. This flaw permits a user query to continue using cached row-level security (RLS) policies after those changes mandate a different policy, persisting until cache invalidation or session termination. The impact allows unauthorized data reads and modifications that were recently permitted but are now forbidden. Affected products include PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. The risk implications involve potential privilege escalation and unauthorized data access within multi-tenant or role-restricted database environments. An attacker must possess the capability to execute queries and tailor their attack precisely to the target application's pattern of privilege removal and specific role-based row security policies to successfully exploit the stale cache behavior.",
  "technicalDetails": "The root cause of the vulnerability lies in incomplete tracking mechanisms within PostgreSQL's query planning and caching subsystem. Specifically, when modifications occur regarding role membership, role attributes, or database ownership, the database engine fails to adequately invalidate cached execution plans that rely on row-level security policies. Because PostgreSQL optimizes performance by reusing previously prepared or cached query plans, subsequent executions of queries within an existing session continue to enforce the outdated security context rather than evaluating the newly applied security constraints.\nThe vulnerable component is the query caching and role-based access control evaluation engine responsible for enforcing row-level security policies. Affected software versions include all PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24.\nExploitation requires an authenticated database user whose privileges or role memberships have been recently revoked or modified. The attack flow proceeds as follows: First, the database administrator or an authorization process revokes specific privileges or alters role memberships that previously allowed the user access to restricted rows via row-level security policies. Second, the attacker leverages an active database session where queries have already compiled and cached execution plans based on the former permissions. Third, the attacker executes crafted queries that leverage the plan reuse mechanism. Because the caching layer fails to detect the altered role attributes or membership changes, the database engine executes the cached plan using the stale RLS evaluation rules.\nThis behavior permits the attacker to complete read and modification operations that should now be forbidden under the updated security policy. The stale policies remain active throughout the session until an external event invalidates the cache or the database connection is explicitly terminated. Post-exploitation impact includes unauthorized data exposure, data tampering, and bypass of intended access control boundaries within the database architecture."
}