CVE-2026-116311 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's DROP OWNED command lacks an authorization check, so a role can remove itself from restrictive row-level security policies. After that, the role can read or change rows the policy was meant to block.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 that use restrictive row-level security policies to limit what roles can see. The flaw lets a role that can run DROP OWNED strip its own policy restrictions. Systems that do not use restrictive row-level security policies are not exposed through this path.
Not affected if no-restrictive-rls-policies, patched-version
Who cares databases, postgresql
SELECT version(); and compare it to the fixed releases below.SELECT * FROM pg_policies WHERE permissive = 'RESTRICTIVE';.18.717.1216.1615.2014.25Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.