PostgreSQL Improper Preservation of Consistency Between Independent Representations of Shared State Vulnerability - CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership role attributes and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application39s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5 17.11 16.15 15.19 and 14.24 are affected.