PostgreSQL: Privilege Fixes and Stats Restore Repairs
Two security-relevant privilege fixes tighten foreign-key checks and remote statistics import, while a second stats fix restores domain statistics that Analyze could build but restore rejected.
Duration: PT2M16S
Episode overview
This episode is a short developer briefing from PostgreSQL.
It explains recent repository work in plain language.
- Show: PostgreSQL
- Published: 2026-09-26T13:03:20Z
- Audio duration: PT2M16S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's September 26th, 2026.
The biggest signal today is privilege correctness: two fixes close gaps where PostgreSQL ran operations with the wrong user's permissions, with direct security implications.
First, foreign key enforcement. Commit 1a84 adds execute permission checks for functions used by the fast path for referential integrity checks — the equality operator and any implicit type cast between foreign and primary key columns. The slower query-based path already checked these as the referenced table's…
Second, remote statistics import. Commit 7d47 fixes privilege handling when Analyze pulls statistics from a foreign server. It was running as the user invoking Analyze, not the foreign table owner, unlike the sampling path. That meant a table owner without remote access could learn sampled data values through…
A related stats theme is restore robustness. Commit 142f fixes stats import for domains built on ranges, multi-ranges and full-text vectors. Analyze could generate histograms and element counts for those domains, but restore rejected them, leaving gaps in planner statistics. A companion update, commit f25c,…
Finally, maintenance: commits 2079 and 3e9b remove…
Nearby episodes from PostgreSQL
- Repack, Vacuum and Replication Hardening
- Snapshot and Visibility Map Correctness
- Concurrency Race Fixes and Replay Relief
- Upgrade Check and Error Code Cleanup
- Simplified Hashing for Sort Estimates
- Weekly Recap - Planner Correctness, Conflict Safety and JSON Fixes
- JSON_TABLE Error Cascade, Join Fix and Test Flakiness
- Correctness Fixes Across Planner, Replication, and Foreign Keys