CVE-2024-10978 [Medium] | Security Vulnerability in Postgresql

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.61%	0.70%	+0.09%
2	2025-12-27	0.70%	0.61%	-0.09%
3	2025-12-23	—	0.70%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.61%

0.70%

+0.09%

2025-12-27

0.70%

0.61%

-0.09%

2025-12-23

—

0.70%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
4.2	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	1.6	2.5	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
4.2	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	1.6	2.5	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

4.2

3.1

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

1.6

2.5

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

4.2

3.1

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

1.6

2.5

[email protected]

OS Trackers for CVE-2024-10978

vendor	priority	summary	link
`alpine`	medium	CVE-2024-10978: 5 source package rows (postgresql, postgresql14, postgresql15, postgresql16, postgresql17); 37 state rows across 11 repos (3.17-main, 3.18-main, 3.19-main, 3.20-community, 3.20-main, 3.21-community, 3.21-main, 3.22-community, 3.22-main, edge-community, edge-main); fixed 19, open 18.	https://security.alpinelinux.org/vuln/CVE-2024-10978
`debian`	not yet assigned	CVE-2024-10978 not yet assigned priority: Debian including 3 source packages (postgresql-13, postgresql-15, postgresql-17), 3 status rows across 3 suites (bookworm, bullseye, trixie): resolved 3.	https://security-tracker.debian.org/tracker/CVE-2024-10978
`gentoo`	high	CVE-2024-10978: 1 GLSA(s) (202412-12), 1 atom(s) (dev-db/postgresql); latest impact high.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2024-10978
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2024-10978
`suse`	medium	CVE-2024-10978 severity moderate: SUSE including 693 source package names (0:libpq5-17.2-150600.13.5.1, 15.10-42.1:libpq5-17.2-150200.5.5.1, …), 1748 product×package rows across 57 product lines (Container containers/open-webui, Container private-registry/harbor-db, … (57 product lines)): Fixed 1509, Known Affected 231, Known Not Affected 8.	https://www.suse.com/security/cve/CVE-2024-10978/
`ubuntu`	medium	CVE-2024-10978 medium priority: Ubuntu including 8 source packages (postgresql-10, postgresql-12, …), 59 status rows across 10 suites (bionic, focal, jammy, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 42, released 9, ignored 3, needs-triage 2, not-affected 2, deferred 1.	https://ubuntu.com/security/CVE-2024-10978

Affected software / configurations for CVE-2024-10978

Vendor	Product	Version	Raw CPE
postgresql	postgresql	>= 12.0, < 12.21	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	>= 13.0, < 13.17	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	>= 14.0, < 14.14	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	>= 15.0, < 15.9	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	>= 16.0, < 16.5	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	17.0	cpe:2.3:a:postgresql:postgresql:17.0:-::::::
postgresql	postgresql	17.0	cpe:2.3:a:postgresql:postgresql:17.0:beta1::::::
postgresql	postgresql	17.0	cpe:2.3:a:postgresql:postgresql:17.0:beta2::::::
postgresql	postgresql	17.0	cpe:2.3:a:postgresql:postgresql:17.0:beta3::::::
postgresql	postgresql	17.0	cpe:2.3:a:postgresql:postgresql:17.0:rc1::::::
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*

References for CVE-2024-10978

URL	Tags
https://www.postgresql.org/support/security/CVE-2024-10978/	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
https://lists.debian.org/debian-lts-announce/2024/11/msg00018.html	Mailing List
https://www.postgresql.org/message-id/173171334532.1547978.1518068370217143844%40wrigleys.postgresql.org	Mailing List

URL

CVE-2024-10978 | PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

Exploit prediction scoring system (EPSS) score for CVE-2024-10978

Common vulnerability scoring system (CVSS) metrics for CVE-2024-10978

Weakness enumeration for CVE-2024-10978

OS Trackers for CVE-2024-10978

Affected software / configurations for CVE-2024-10978

References for CVE-2024-10978