CVE-2026-116327

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 12, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1163288.8Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user ruCVE-2026-1163298.8Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the CVE-2026-116338.8Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a maliciCVE-2026-1163308.8Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the clCVE-2026-1163318.8Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user CVE-2026-1163328.8Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the databaCVE-2026-1163336.5Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a functioCVE-2026-1163358.8Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating systeCVE-2026-1163368.8Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system uCVE-2026-1163370.6Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.CVE-2026-1163397.3A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1CVE-2026-116349.6Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox esc
CVE-2026-116327: Medium severity, CVSS 4.3 | Vulnix