CVE-2025-8713 in PostgreSQL
Summary
by MITRE • 08/14/2025
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2025
The vulnerability described in CVE-2025-8713 represents a significant information disclosure flaw within PostgreSQL's query optimizer statistics system that undermines fundamental access control mechanisms. This issue specifically targets the way PostgreSQL maintains and utilizes statistical data during query planning processes, creating a pathway for unauthorized data exposure through carefully crafted queries that exploit the sampling mechanisms used to generate optimizer statistics. The vulnerability exists in the statistical sampling process that PostgreSQL employs to build histograms and most-common-values lists for query optimization purposes, where these statistics are inadvertently exposed to users who should not have access to the underlying data.
The technical implementation of this vulnerability stems from the interaction between PostgreSQL's statistical sampling mechanisms and its access control systems. When PostgreSQL generates statistics for table columns, it samples data from the underlying tables to create histograms and most-common-values lists that help the query planner make informed decisions about query execution. However, the flaw allows users to construct leaky operators that can access this sampled statistical data even when they lack proper permissions to view the actual table data through views or when row security policies should have hidden specific rows. This occurs because the statistical sampling process does not properly enforce the same access controls that apply to direct data access, creating a bypass mechanism that allows unauthorized information disclosure.
The operational impact of this vulnerability extends beyond simple data exposure, as it can potentially reveal sensitive information that row security policies are designed to protect. Attackers can exploit this weakness to reconstruct information about data that should be hidden through partitioning or inheritance hierarchies, effectively circumventing the security controls that are meant to protect sensitive data. The vulnerability affects multiple PostgreSQL versions including those prior to 17.6, 16.10, 15.14, 14.19, and 13.22, indicating a long-standing issue that has persisted despite previous attempts to address similar vulnerabilities such as CVE-2017-7484 and CVE-2019-10130. This suggests that while earlier patches addressed some aspects of statistical data exposure, they failed to fully resolve the core issue with how sampled statistics interact with access control mechanisms.
Security implications of this vulnerability align with CWE-200 (Information Exposure) and can be categorized under ATT&CK technique T1213.002 (Data from Information Repositories) as it enables unauthorized access to data through indirect means. The vulnerability creates a persistent information leakage channel that can be exploited by malicious users to gain insights into data that should remain protected, potentially enabling more sophisticated attacks that leverage the leaked information for privilege escalation or further exploitation. Organizations running affected PostgreSQL versions face significant risk of data exposure through this vulnerability, particularly in environments where sensitive data is protected through view-based access controls or row-level security policies. The remediation requires updating to the patched versions of PostgreSQL, as no effective workarounds exist that can properly isolate the statistical sampling process from access control enforcement without compromising query optimization performance.
This vulnerability demonstrates the complexity of maintaining security boundaries in database systems where statistical data generation and query optimization interact with access control mechanisms. The flaw represents a fundamental design gap in how PostgreSQL handles the boundary between statistical sampling for optimization purposes and access control enforcement, creating a persistent security weakness that can be exploited by users with minimal privileges to gain unauthorized insights into protected data. The persistence of this vulnerability across multiple major PostgreSQL releases indicates that the underlying architectural challenge requires careful consideration of how statistical data can be generated and used without compromising data confidentiality.