CVE-2024-0985 is a high severity flaw (CVSS 8.0) in PostgreSQL. Fixed in 16.2, 15.6, 14.11, 13.14 and 12.18, published 8 February 2024. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
PostgreSQL versions before 16.2, 15.6, 14.11, 13.14 and 12.18.
The record gives a CVSS base score of 8.0 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The PostgreSQL page gives a score of 8.0 without a label. NVD in the record lists 8.0 High. They agree. The advisory notes version 16 was added as affected on 19 June 2024, after the first publication. The weakness class is CWE-271.
The PostgreSQL advisory scores this 8.0 using CVSS 3.0, vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The attacker must create a materialized view and lure a superuser or a member of the attacker roles into running REFRESH MATERIALIZED VIEW CONCURRENTLY on it.
Fixed in 16.2, 15.6, 14.11, 13.14 and 12.18, published 8 February 2024.
How to check if you're exposed
Run SELECT version(); in psql, or the psql version command for the client. Package users can check with dpkg -l | grep postgresql or rpm -qa | grep postgresql.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0985 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of PostgreSQL in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. Fixed in 16.2, 15.6, 14.11, 13.14 and 12.18, published 8 February 2024.
- Apply mitigations while you wait: update to the fixed minor release. Until then, avoid refreshing materialized views owned by roles you do not trust.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is a privilege dropping error, CWE-271. REFRESH MATERIALIZED VIEW CONCURRENTLY is meant to run SQL functions as the view owner, so that refreshing an untrusted view is safe. The privilege drop happened too late, so functions written by the view creator could run with the rights of the person who issued the command.
The risk is highest where a superuser refreshes views created by other roles. The attacker needs the ability to create objects and a victim willing to run the command. Role design, such as who may create materialized views, limits the exposure alongside patching.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
Who is at risk?
Mainly databases where superusers or privileged roles refresh materialized views created by less trusted roles.
Where can I confirm the fixed version?
Check the vendor or project advisory first. Fixed in 16.2, 15.6, 14.11, 13.14 and 12.18, published 8 February 2024. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://lists.debian.org/debian-lts-announce/2024/03/msg00017.html
- https://saites.dev/projects/personal/postgres-cve-2024-0985/
- https://www.postgresql.org/support/security/CVE-2024-0985/
- https://security.netapp.com/advisory/ntap-20241220-0005/
- Safeguard Gold record for CVE-2024-0985
Last reviewed: 19 October 2026.
