CVE-2026-14666 describes a vulnerability in PostgreSQL where incomplete tracking of changes to role membership, role attributes, and database ownership causes queries to continue using cached row-level security policies that are no longer valid. This occurs due to plan reuse with stale policies remaining effective until cache invalidation or session termination. The flaw allows users to perform reads and modifications that should have been forbidden after privilege changes. The vulnerability affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. The CVSS 3.1 score is 4.2 (medium severity) with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker with low privileges can exploit this vulnerability to continue accessing or modifying data that should have been restricted due to recent changes in role membership or security policies. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires knowledge of the application's privilege removal patterns and row-level security policies. The vulnerability persists until the cache is invalidated or the session ends.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider terminating sessions or otherwise invalidating cached plans after changes to role membership, role attributes, or database ownership to prevent use of stale row-level security policies.