Servers and applications

CVE-2026-16237

PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition

Severity: Medium 5.4
Published: 12 Nov 2026
Last changed: 12 Nov 2026
Added to UpHeron: 13 Nov 2026
Fixed in: 14.25, 15.20, 16.16, 17.12, 18.7
Weakness: CWE-424
Attack: Over the network · Needs a user account · No user action needed
Attacker can: Read some data · Change some data
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Sources: CVE Program

Description

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

From the CVE Program.

Affected software

Software	Affected versions
PostgreSQLServers and applications · `cna:n/a\|postgresql`	Every version before 14.25 From 15 before 15.20 From 16 before 16.16 From 17 before 17.12 From 18 before 18.7

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-16237