ALPINE-CVE-2026-116311: Medium severity alpine/postgresql15 vulnerability
Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs access as a PostgreSQL role that can execute DROP OWNED. Exploitation consists of using DROP OWNED to remove that role from restrictive row-level security policies, then issuing queries that access rows previously denied by those policies.
Which PostgreSQL releases are affected?
Affected versions are PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25. Systems on those release branches should update to the listed fixed release or later.
What is the impact after exploitation?
A role may be able to read or modify rows that restrictive row-level security policies were intended to deny. The provided severity vector indicates confidentiality and integrity impact, with no availability impact.