PostgreSQL row security caching disregards role modifications

Description

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Scores

EPSS (exploitation in 30 days)

0.21% · top 89% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.2.

Weakness

• CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State (opens in a new tab)All about CWE-1250 and its CVEs

Affected products

• PostgreSQL

  • affected 18 – < 18.6
  • affected 17 – < 17.11
  • affected 16 – < 16.15
  • affected 15 – < 15.19
  • affected < 14.24

References (1)

• https://www.postgresql.org/support/security/CVE-2026-14666/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-14666](https://trackcve.app/badge/CVE-2026-14666.svg)](https://trackcve.app/cve/CVE-2026-14666)

Record last updated 29 Aug 2026, 23:07 UTC.