AZL-113696: CVE-2026-116311 affecting package postgresql 16.15-1
Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The listed Azure Linux package version is postgresql 16.15-1, which is below the fixed 16.16 release.
What access does an attacker need to exploit it?
An attacker needs to be able to act as a PostgreSQL role and execute DROP OWNED. The issue is relevant where restrictive row-level security policies are intended to prevent that role from reading or modifying particular rows.
Are systems without row-level security policies affected in practice?
The described impact depends on restrictive row-level security policies. Without such policies denying the role access to rows, this specific bypass does not provide the stated read or modify capability.
How can I determine whether my instance is vulnerable?
Check the PostgreSQL major and patch version in use and compare it with the fixed release for that major version. Versions earlier than 18.7, 17.12, 16.16, 15.20, or 14.25 are affected; also identify roles subject to restrictive row-level security policies that can execute DROP OWNED.