{"id":"CVE-2026-116327","kind":"vulnerability","aliases":["CVE-2026-116327"],"related":[],"title":"PostgreSQL: security_barrier views can leak hidden values to database users","description":"Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A database user with query access can apply a leaky function to a CASE test value or internal parameter and infer column values hidden by a security_barrier view. The attacker gets read access to protected data they should not see, one inferred value at a time.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-security-barrier-views","trusted-users-only"],"how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Look for views created with `security_barrier` (`\\d+ viewname` shows the option) that hide sensitive columns from other roles.","fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, `14.25` (affected: versions before these)","status":"open","published_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","triaged_at":"2026-11-12T15:44:01+00:00","updated_at":"2026-11-12T15:44:01+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:44:01Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, `14.25` (affected: versions before these)","reach":"network","title":"PostgreSQL: security_barrier views can leak hidden values to database users","impact":"medium","summary":"A database user with query access can apply a leaky function to a CASE test value or internal parameter and infer column values hidden by a security_barrier view. The attacker gets read access to protected data they should not see, one inferred value at a time.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"database user reads values hidden by security_barrier views","analyst_note":"Product data for affected ranges came from the description only; check the PostgreSQL security advisory for exact range details.\n","how_to_check":"- Run `SELECT version();` in psql and compare against the fixed versions below.\n- Look for views created with `security_barrier` (`\\d+ viewname` shows the option) that hide sensitive columns from other roles.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-security-barrier-views","trusted-users-only"],"who_is_affected":"Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected, and only where users with query access rely on security_barrier views to hide columns. Databases without security_barrier views or without untrusted database users can deprioritize this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4572,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116327':14A,17A '-2026':13A,16A '14.25':120C '15.20':118C '16.16':117C '17.12':116C '18.7':115C 'access':29B,57B 'affect':122C 'allow':80C 'appli':31B,94C 'attack':54B 'barrier':3A,51B,78C,91C 'case':37B,100C 'column':45B,111C 'cve':12A,15A 'data':60B 'databas':10A,18B,25B,82C 'exposur':71C 'function':34B,97C 'get':55B 'hidden':7A,47B,87C 'host':23B 'indirect':107C 'infer':44B,66B,85C 'inform':74C 'intern':41B,104C 'leak':6A 'leaki':33B,96C 'one':65B 'paramet':42B,105C 'postgresql':1A,19B,76C,114C 'process':79C 'protect':59B,110C 'queri':28B 'read':56B 'repres':108C 'runtim':20B 'secur':2A,50B,77C,90C 'see':64B 'self':22B 'self-host':21B 'sensit':73C 'test':38B,101C 'time':70B 'user':11A,26B,83C 'valu':8A,39B,46B,67B,86C,102C 'version':112C 'via':93C 'view':4A,52B,92C","nicknames":[],"mitigations":[],"who_affected":"Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected, and only where users with query access rely on security_barrier views to hide columns. Databases without security_barrier views or without untrusted database users can deprioritize this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","medium","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116327':14A,17A '-2026':13A,16A 'barrier':3A 'cve':12A,15A 'databas':10A 'hidden':7A 'leak':6A 'postgresql':1A 'secur':2A 'user':11A 'valu':8A 'view':4A","search_b":"'access':29B,57B 'appli':31B 'attack':54B 'barrier':51B 'case':37B 'column':45B 'data':60B 'databas':18B,25B 'function':34B 'get':55B 'hidden':47B 'host':23B 'infer':44B,66B 'intern':41B 'leaki':33B 'one':65B 'paramet':42B 'postgresql':19B 'protect':59B 'queri':28B 'read':56B 'runtim':20B 'secur':50B 'see':64B 'self':22B 'self-host':21B 'test':38B 'time':70B 'user':26B 'valu':39B,46B,67B 'view':52B","search_c":"'14.25':120C '15.20':118C '16.16':117C '17.12':116C '18.7':115C 'affect':122C 'allow':80C 'appli':94C 'barrier':78C,91C 'case':100C 'column':111C 'databas':82C 'exposur':71C 'function':97C 'hidden':87C 'indirect':107C 'infer':85C 'inform':74C 'intern':104C 'leaki':96C 'paramet':105C 'postgresql':76C,114C 'process':79C 'protect':110C 'repres':108C 'secur':77C,90C 'sensit':73C 'test':101C 'user':83C 'valu':86C,102C 'version':112C 'via':93C 'view':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116327","severity":null,"published_at":"2026-11-12T15:17:41+00:00","modified_at":"2026-11-12T15:17:41+00:00","first_seen_at":"2026-11-12T15:41:55+00:00","fetched_at":"2026-11-12T15:41:55+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}