CVE-2026-16237 PUBLISHED

PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition

Assigner: PostgreSQL
Reserved: 20.07.2026 Published: 12.11.2026 Updated: 12.11.2026

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor n/a
Product PostgreSQL
Versions Default: unaffected
  • affected from 18 to 18.7 (excl.)
  • affected from 17 to 17.12 (excl.)
  • affected from 16 to 16.16 (excl.)
  • affected from 15 to 15.20 (excl.)
  • affected from 0 to 14.25 (excl.)

Affected Configurations

attacker has INSERT and UPDATE privileges on an auto-updatable view but lacks one of those on its base table

Credits

  • The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem.

References

Problem Types

  • Improper Protection of Alternate Path CWE