Invalidate plan cache after role changes. Role membership, role attribute, and database ownership changes may impact the expected behavior of row-level security policies, but currently the plan cache doesn't take notice. To fix, register syscache callbacks on pg_auth_members, pg_authid, and pg_database that invalidate the role-dependent plans. Changes to other databases' pg_database rows are ignored.
Reported-by: Ilya Staroverov <[email protected]> Reported-by: Shinya Kato <[email protected]> Author: Ilya Staroverov <[email protected]> Author: Shinya Kato <[email protected]> Co-authored-by: Nathan Bossart <[email protected]> Reviewed-by: Tom Lane <[email protected]> Security: CVE-2026-14666 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f5f2da795b395449ca2970330bbdc88f8366bf68 Author: Nathan Bossart <[email protected]> Modified Files -------------- src/backend/utils/adt/acl.c | 2 +- src/backend/utils/cache/plancache.c | 60 ++++++++++++++++++++++++++++++++++++- src/include/utils/acl.h | 3 ++ 3 files changed, 63 insertions(+), 2 deletions(-)
