CVE-2026-120154 PUBLISHED

PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies

Assigner: PostgreSQL
Reserved: 30.10.2026 Published: 12.11.2026 Updated: 12.11.2026

Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor n/a
Product PostgreSQL
Versions Default: unaffected
  • affected from 18 to 18.7 (excl.)
  • affected from 17 to 17.12 (excl.)
  • affected from 16 to 16.16 (excl.)
  • affected from 15 to 15.20 (excl.)
  • affected from 0 to 14.25 (excl.)

Affected Configurations

attacker has INSERT, UPDATE, and applicable SELECT privileges on a table with a row security policy

Credits

  • The PostgreSQL project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, Nicholas Carlini, Joao Detomini, Josef Šimánek, and Qing Xu for reporting this problem.

References

Problem Types

  • Improper Protection of Alternate Path CWE