Skip to main content

PostgreSQL CVE-2026-14666

| EUVDEUVD-2026-57834 MEDIUM
Improper Preservation of Consistency Between Independent Representations of Shared State (CWE-1250)
2026-08-13 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 GHSA-fvh5-w7wg-xp3g
Information Disclosure PostgreSQL
4.2
CVSS 3.1 · Vendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Share

Severity by source

Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007) PRIMARY
4.2 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
4.2 MEDIUM

Network vector confirmed for remotely accessible PostgreSQL; AC:H for narrow privilege-revocation timing window; PR:L for required authenticated session; no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007).

CVSS VectorVendor: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 14:02 EUVD
Analysis Generated
Aug 13, 2026 - 13:44 vuln.today
CVE Published
Aug 13, 2026 - 13:17 cve.org
MEDIUM 4.2

DescriptionCVE.org

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

AnalysisAI

Stale row-level security policy execution in PostgreSQL 14 through 18 permits authenticated database users to read or modify rows they are no longer authorized to access after role membership, role attributes, or database ownership are changed. The flaw lies in PostgreSQL's plan cache, which does not invalidate cached RLS policies when such privilege changes occur, meaning a revoked permission continues to be honored until the session ends or an unrelated cache invalidation event fires. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following specific conditions to be simultaneously present: row-level security must be explicitly enabled (CREATE POLICY / ALTER TABLE ENABLE ROW LEVEL SECURITY) on at least one table targeted by the attacker; the attacker must hold a valid authenticated database session (PR:L - a database user credential) that was established before a privilege change event; and the privilege change must be one of the tracked-incomplete types - role membership modification, role attribute change, or database ownership transfer - rather than a direct object privilege change. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 4.2 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N reflects a measured real-world risk: while the attack is network-reachable, the High Complexity (AC:H) correctly captures the narrow exploitation window - the attacker must hold an active authenticated session spanning the interval between privilege revocation and plan cache expiration or connection termination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is to upgrade to a patched release - PostgreSQL 14.24, 15.19, 16.15, 17.11, or 18.5 - as documented in the vendor advisory at https://www.postgresql.org/support/security/CVE-2026-14666/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-1250 – Improper Preservation of Consistency Between Independent Representations of Shared State

View all
CVE-2025-30189 HIGH
7.4
CVE-2023-22405 MEDIUM
6.5
CVE-2022-22234 MEDIUM
5.5
CVE-2025-32899 MEDIUM
4.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-14666 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy