Invalidate plan cache after role changes.
Role membership, role attribute, and database ownership changes may
impact the expected behavior of row-level security policies, but
currently the plan cache doesn't take notice. To fix, register
syscache callbacks on pg_auth_members, pg_authid, and pg_database
that invalidate the role-dependent plans. Changes to other
databases' pg_database rows are ignored.
Reported-by: Ilya Staroverov <i.staroverov@ftdata.ru>
Reported-by: Shinya Kato <shinya11.kato@gmail.com>
Author: Ilya Staroverov <i.staroverov@ftdata.ru>
Author: Shinya Kato <shinya11.kato@gmail.com>
Co-authored-by: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Security: CVE-2026-14666
Backpatch-through: 14
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/0b12f56bfac12e5930ee22071722082b0a45346b
Author: Nathan Bossart <nathan@postgresql.org>
Modified Files
--------------
src/backend/utils/adt/acl.c | 2 +-
src/backend/utils/cache/plancache.c | 60 ++++++++++++++++++++++++++++++++++++-
src/include/utils/acl.h | 3 ++
3 files changed, 63 insertions(+), 2 deletions(-)
