CVE-2026-14666

A flaw in PostgreSQL allows users to bypass row-level security RLS due to incomplete tracking of user role and database ownership changes. Active sessions may continue using cached, outdated security policies, enabling unauthorized read or write access to data. Exploitation requires the attacker ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104759 advisory. Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security...

CVE-2026-14666: Improper Preservation of Consistency Between Independent Representations of Shared State

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...