What’s Vulnerable › Vulnerabilities

CVE-2026-65314: Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-203

Description

Electric Postgres Sync versions below 1.6.10 contains an information disclosure vulnerability that allows attackers to infer the values of excluded columns by crafting subset where clause conditions against shape responses. Attackers can observe whether subset where conditions match rows to deduce sensitive field data even though those columns are not returned in shape responses, bypassing column-based access restrictions.

Affected products

• ElectricSQL Electric Postgres Sync: through 1.6.10

References

• https://github.com/electric-sql/electric
• https://github.com/electric-sql/electric/security/advisories/GHSA-c82q-v86f-c87f
• https://www.vulncheck.com/advisories/electric-postgres-sync-excluded-column-value-inference-via-subset-where-clauses

Get alerted when CVE-2026-65314 or the next vulnerability affects your stack