CVE-2025-8713: PostgreSQL Information Disclosure Flaw

CVE-2025-8713 Overview

CVE-2025-8713 is an information disclosure vulnerability in PostgreSQL that allows a low-privileged user to read sampled data from views and row-security-protected tables they are not authorized to access. The flaw resides in the query planner's use of optimizer statistics, including histograms and most-common-values (MCV) lists. An attacker can craft a leaky operator that bypasses view access control lists (ACLs) and row security policies in partitioning or table inheritance hierarchies. This weakness is tracked under [CWE-1230: Exposure of Sensitive Information Through Metadata]. Prior fixes CVE-2017-7484 and CVE-2019-10130 attempted to close this class of issue, but a gap remained. Affected versions include PostgreSQL releases before 17.6, 16.10, 15.14, 14.19, and 13.22.

Critical Impact
An authenticated database user can extract sampled column values from views and rows that access controls should conceal, resulting in unauthorized disclosure of sensitive tenant, customer, or business data.

Affected Products

PostgreSQL versions prior to 17.6
PostgreSQL versions prior to 16.10, 15.14, and 14.19
PostgreSQL versions prior to 13.22

Discovery Timeline

2025-08-14 - CVE-2025-8713 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8713

Vulnerability Analysis

PostgreSQL collects optimizer statistics by sampling column data. The planner consults these statistics, notably histograms and most-common-values lists, to select efficient query plans. The vulnerability arises because these statistics can be indirectly exposed to users who lack access to the underlying rows or views.

A user who defines a leaky operator can trigger the planner to evaluate that operator against sampled values before ACL and row security policy enforcement completes. The operator observes the sampled values and leaks them to the caller. This bypasses both view ACLs and row security policies in partitioning or inheritance hierarchies.

Exploitation requires an authenticated database session and non-trivial crafting of a custom operator or function, which is reflected in the high attack complexity rating.

Root Cause

The root cause is incomplete enforcement of access controls when the query planner exposes column statistics. Statistics-derived data flows through user-controllable operators before the executor enforces row-level and view-level restrictions. This is a metadata-based information exposure pattern classified under [CWE-1230].

Attack Vector

An authenticated user with CONNECT privileges to the database creates a function or operator marked in a way that the planner treats as cheap enough to evaluate against statistics samples. The user then issues queries against restricted views or row-security-protected tables. During planning, PostgreSQL passes histogram bucket boundaries and most-common-values to the crafted operator, which records or returns the sampled values. The technique yields data the querying role should not be able to read directly. See the PostgreSQL Security Advisory for the full technical description.

Detection Methods for CVE-2025-8713

Indicators of Compromise

Creation of user-defined operators or functions by low-privileged roles, especially those marked with attributes that influence planner cost estimation.
Repeated EXPLAIN or query activity from non-privileged roles targeting views or partitioned tables that enforce row security policies.
Unexpected pg_proc or pg_operator catalog entries owned by application or tenant roles.

Detection Strategies

Audit PostgreSQL server logs for CREATE OPERATOR and CREATE FUNCTION statements issued by non-administrative accounts.
Enable log_statement = 'ddl' and review DDL events for roles that should only perform DML.
Compare installed PostgreSQL minor version against the fixed releases (17.6, 16.10, 15.14, 14.19, 13.22) using SELECT version();.

Monitoring Recommendations

Forward PostgreSQL audit logs to a centralized SIEM and alert on DDL performed by application-tier roles.
Track query patterns that repeatedly probe row-security-protected tables from the same session.
Monitor for privilege changes and new operator or function definitions in production catalogs.

How to Mitigate CVE-2025-8713

Immediate Actions Required

Upgrade PostgreSQL to a patched minor version: 17.6, 16.10, 15.14, 14.19, or 13.22, or later.
Inventory user-defined operators and functions owned by non-superuser roles and remove any that are not required.
Revoke CREATE privileges on schemas from roles that do not require the ability to define functions or operators.

Patch Information

The PostgreSQL Global Development Group released fixed versions on the August 2025 update cycle. Apply the upgrade using your platform's package manager or the official PostgreSQL binaries, then restart the database service. Full details are available in the PostgreSQL Security Advisory for CVE-2025-8713.

Workarounds

Restrict function and operator creation by executing REVOKE CREATE ON SCHEMA public FROM PUBLIC; and granting CREATE only to trusted roles.
Avoid granting CONNECT on sensitive databases to roles that do not require query access.
Where feasible, replace reliance on row security policies for hard tenant isolation with separate databases or schemas until patching is complete.

bash

# Verify PostgreSQL version and restrict function creation
psql -c "SELECT version();"
psql -c "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"
psql -c "REVOKE CREATE ON DATABASE app_db FROM app_readonly;"