STIGQter STIGQter: STIG Summary: Crunchy Data Postgres 16 Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

PostgreSQL must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).

DISA Rule

SV-261924r1000777_rule

Vulnerability Number

V-261924

Group Title

SRG-APP-000380-DB-000360

Rule Version

CD16-00-007800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure PostgreSQL to enforce access restrictions associated with changes to the configuration of PostgreSQL or database(s).

Use ALTER ROLE to remove accesses from roles:

$ psql -c "ALTER ROLE <role_name> NOSUPERUSER"

Use REVOKE to remove privileges from databases and schemas:

$ psql -c "REVOKE ALL PRIVILEGES ON <table> FROM <role_name>"

Check Contents

To list all the permissions of individual roles, as the database administrator (shown here as "postgres"), run the following SQL:

$ sudo su - postgres
$ psql -c "\du"

If any role has SUPERUSER that should not, this is a finding.

List all the permissions of databases and schemas by running the following SQL:

$ sudo su - postgres
$ psql -c "\l"
$ psql -c "\dn+"

If any database or schema has update ("W") or create ("C") privileges and should not, this is a finding.

Vulnerability Number

V-261924

Documentable

False

Rule Version

CD16-00-007800

Severity Override Guidance

To list all the permissions of individual roles, as the database administrator (shown here as "postgres"), run the following SQL:

$ sudo su - postgres
$ psql -c "\du"

If any role has SUPERUSER that should not, this is a finding.

List all the permissions of databases and schemas by running the following SQL:

$ sudo su - postgres
$ psql -c "\l"
$ psql -c "\dn+"

If any database or schema has update ("W") or create ("C") privileges and should not, this is a finding.

Check Content Reference

M

Target Key

5598