When the Planner Becomes the Attack Surface: Adversarial Query Planning, RLS Bypass Chains, and Defense-in-Depth for PostgreSQL

PostgreSQL deployments across South Asia increasingly adopt Payment Card Industry Data Security Standard (PCI-DSS) aligned hardening-dedicated firewalls, SCRAM-SHA-256 authentication, TLS enforcement, granular grants, Row-Level Security (RLS), and centralized auditing-as the definitive security posture. This research argues that such compliance-oriented configuration, while necessary, creates a dangerous illusion of safety when the database engine itself becomes the attack surface. Drawing on offensive security research methodology, upstream CVE analysis, and a synthesis of practitioner frameworks articulated by McLean (2019), Teleport (2022), and Percona (2025), this paper presents a dual-layer threat model distinguishing perimeter hardening from adversarial exploitation of PostgreSQL internals. The study examines three emergent vulnerability classes: (1) plan-cache and role-transition failures enabling RLS bypass (CVE-2024-10976, CVSS 4.2); (2) optimizer statistics side-channels leaking protected data through non-LEAKPROOF operators (CVE-2025-8713, CVSS 3.1); and (3) operational attack primitives including prepared-statement plan cliffs and planner resource exhaustion that evade conventional monitoring. Case synthesis from extension trust boundary failures (postgresql_anonymizer, CVE-2024-2338/2339) and historical planner CVEs demonstrates that authorization logic implemented at the SQL policy layer can be silently subverted without network intrusion or credential theft. The paper contributes the Adversarial PostgreSQL Security Assessment Framework (APSAF)-a structured methodology integrating PCI-aligned baseline controls with advanced detection strategies: variance-based query monitoring, leakproof operator audits, safe role-transition patterns, extension supply-chain review, and patch-baseline governance. Findings are particularly relevant to multi-tenant SaaS, government digitization, and university-scale deployments in Nepal, where RLS is frequently treated as the primary isolation mechanism. The research concludes that PostgreSQL security maturity must evolve from configuration checklists to engine-aware adversarial analysis-treating the cost-based optimizer and its plan cache as first-class components of the threat model.