CVE-2026-116327: PostgreSQL security_barrier analysis can expose hidden values through indirect expressions
Exposure of sensitive information in PostgreSQL securitybarrier processing allows a database user to infer values hidden by a securitybarrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The issue concerns deployments using security_barrier views to protect sensitive column values.
What access does an attacker need?
An attacker needs database access as a user with low privileges. Exploitation does not require user interaction and can be performed over the network.
What can an attacker obtain through this issue?
A database user may infer sensitive values that a security_barrier view is intended to hide. The disclosed information is derived by applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column.
What versions remediate the issue?
Upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25, as applicable to the major version in use.