ALPINE-CVE-2026-116327: Medium severity alpine/postgresql15 vulnerability
Exposure of sensitive information in PostgreSQL securitybarrier processing allows a database user to infer values hidden by a securitybarrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PostgreSQL 14 before 14.25, 15 before 15.20, 16 before 16.16, 17 before 17.12, or 18 before 18.7 are affected. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What does an attacker need to exploit it?
An attacker needs database-user privileges. Exploitation involves applying a leaky function to a CASE test value or an internal parameter that indirectly represents a column protected by a security_barrier view.
What information can be exposed?
A database user may infer values that are intended to be hidden by a security_barrier view. The available severity vector indicates confidentiality impact only, with no stated integrity or availability impact.