CVE-2026-16237
PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
| CWE | CWE-424 |
| Vendor | n/a |
| Product | postgresql |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a postgresql
Be the first to know when new medium vulnerabilities affecting n/a postgresql are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / PostgreSQL
18 < 18.7 17 < 17.12 16 < 16.16 15 < 15.20 0 < 14.25
References
Credits
The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem.