Medium [CVE-2026-14666] Row security caching disregards role modifications leading to unauthorized data access

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session.

This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies.

Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Active sessions may continue using cached, outdated security policies, enabling unauthorized read or write access to data.

Exploitation requires the attacker to understand the application's specific privilege removal configurations. This vulnerability in PostgreSQL is of Moderate impact.

It allows a low-privileged authenticated user to bypass row-level security policies due to stale cached plans, potentially leading to unauthorized data access or modification. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

Weakness: CWE-524. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Self-service automation portal 2.