---
id: "CVE-2026-116311"
page: "https://infrastack.ai/live/CVE-2026-116311"
kind: "vulnerability"
aliases: ["CVE-2026-116311"]
title: "PostgreSQL: DROP OWNED lets a role bypass restrictive row-level security policies"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["databases", "postgresql", "runtime"]
not_affected_if: ["no-restrictive-rls-policies", "patched-version"]
published_at: "2026-11-12T15:17:39+00:00"
first_seen_at: "2026-11-12T15:41:54+00:00"
updated_at: "2026-11-12T15:43:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116311", "first_seen_at": "2026-11-12T15:41:54+00:00"}]
exploit_sources: []
---

# PostgreSQL: DROP OWNED lets a role bypass restrictive row-level security policies

Link for people: https://infrastack.ai/live/CVE-2026-116311 (this .md is for agents)

PostgreSQL's DROP OWNED command lacks an authorization check, so a role can remove itself from restrictive row-level security policies. After that, the role can read or change rows the policy was meant to block.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the server version with `SELECT version();` and compare it to the fixed releases below.
- Look for restrictive row-level security policies with `SELECT * FROM pg_policies WHERE permissive = 'RESTRICTIVE';`.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116311

## From the sources

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_