CVE-2026-14666

score

5.0

cvss

4.2

epss

0.2%

published

2026-08-13

kev added

—

first seen

2026-10-21

PostgreSQL < 18.5, 17.11, 16.15, 15.19, and 14.24 contains a broken access control caused by incomplete tracking of changes to role membership, attributes, and database ownership, letting attackers bypass updated row-level security policies via cached plan reuse, exploit requires tailored attack to specific privilege removal and role policies.