Row-Level Security Side Channels Turn Membership Tests Into Full Record Reconstruction in PostgreSQL and Elasticsearch

arXiv 2608.11730·high signalXBlueskyLinkedInCopy link

Fine-grained access control like row-level security (RLS) and document-level security (DLS) is widely deployed in multi-tenant databases, and the paper shows its existence-leakage can be amplified into reconstruction. Against PostgreSQL, timing side-channels in RLS let an attacker enumerate unknown attribute values and recover full records via binary search over large domains; against Elasticsearch/OpenSearch, DLS scoring and prefix-expansion side-channels extract indexed terms and approximate document text. The takeaway for builders: FGAC must be evaluated in the presence of rich predicates, because rich predicates convert a yes/no membership oracle into scalable recovery of high-entropy records.