CVE-2026-65314 Overview
CVE-2026-65314 is an information disclosure vulnerability affecting Electric Postgres Sync versions below 1.6.10. The flaw allows authenticated attackers to infer the values of excluded columns by crafting subset WHERE clause conditions against shape responses. Although the excluded columns are not returned in shape responses, attackers can observe whether their conditions match rows and deduce sensitive field data. This bypasses column-based access restrictions intended to protect confidential fields. The vulnerability is categorized under CWE-203: Observable Discrepancy.
Critical Impact
Attackers with query access can extract sensitive column values that were explicitly excluded from responses, defeating column-level access controls in Electric Postgres Sync deployments.
Affected Products
- Electric Postgres Sync versions below 1.6.10
- Electric SQL sync engine deployments exposing shape APIs
- Applications relying on column exclusion for row-level access control
Discovery Timeline
- 2026-07-21 - CVE-2026-65314 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-65314
Vulnerability Analysis
Electric Postgres Sync exposes shape APIs that allow clients to subscribe to filtered subsets of Postgres tables. Operators can configure which columns are returned to restrict exposure of sensitive fields. The vulnerability arises because the WHERE clause filter accepts predicates that reference excluded columns. When a client submits a shape request with a WHERE condition referencing an excluded column, the server evaluates the predicate against the underlying row. The response reveals whether rows match, even though the column value itself is redacted. An attacker can iterate through candidate values or ranges using binary search to reconstruct the excluded data. This is a classic side-channel disclosure pattern documented under CWE-203.
Root Cause
The root cause is inconsistent enforcement between the shape response projection and the shape filter parser. Column exclusion applies only to the returned payload, not to predicates permitted in the WHERE clause. The predicate evaluator treats excluded columns as queryable, creating an observable discrepancy between filtered and unfiltered results.
Attack Vector
An authenticated network attacker issues shape subscription requests with iterative WHERE clauses such as secret_field > 'a', secret_field > 'm', and so on. By observing the presence or absence of matching rows in each response, the attacker performs a binary search to recover exact column values. No elevated privileges beyond legitimate query access are required, and the attack is fully remote.
The vulnerability manifests in the shape filter validation path. See the GitHub Security Advisory GHSA-c82q-v86f-c87f for technical details.
Detection Methods for CVE-2026-65314
Indicators of Compromise
- Repeated shape subscription requests from a single client with WHERE clauses referencing columns not present in the response projection
- High volume of near-identical shape requests differing only by literal values in comparison predicates, indicative of binary search enumeration
- Client sessions issuing shape queries with predicates against columns that are administratively excluded from the shape definition
Detection Strategies
- Parse Electric shape API request logs and flag WHERE clauses that reference columns absent from the requested shape's return set
- Rate-limit and alert on clients issuing more than a threshold of shape requests per minute against the same shape with varying comparison operators
- Correlate shape API access logs with Postgres query logs to identify predicate patterns consistent with value inference
Monitoring Recommendations
- Enable verbose request logging on the Electric sync service and forward logs to a centralized analytics platform for pattern analysis
- Monitor for anomalous entropy in WHERE clause literals across sequential requests from the same authenticated identity
- Audit shape definitions to inventory which columns are excluded and baseline normal query patterns against those shapes
How to Mitigate CVE-2026-65314
Immediate Actions Required
- Upgrade Electric Postgres Sync to version 1.6.10 or later as soon as possible
- Review shape definitions and identify any that rely on column exclusion to protect sensitive fields
- Rotate or invalidate any credentials or tokens whose values may have been exposed through prior shape queries
Patch Information
The maintainers released a fix in Electric Postgres Sync version 1.6.10. The patch restricts shape WHERE clause predicates to reference only columns included in the shape's return projection. Refer to the Electric SQL repository and the Vulncheck advisory for release notes and remediation guidance.
Workarounds
- Remove sensitive columns from tables exposed through Electric shapes and store them in separate tables that are not synced
- Enforce row-level security in Postgres so that unauthorized rows are not visible to the sync service role, eliminating the inference channel
- Apply an application-layer proxy that rejects shape requests whose WHERE clauses reference columns outside the shape's declared projection
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
