CVE-2026-116312 · Runtime
NO FIX YET · SEE WHAT TO DO
A bug in how PostgreSQL's MERGE command tracks transition capture on partitioned tables can make an AFTER trigger process the wrong new row. A user who can modify table data can use a MERGE that runs an INSERT before an UPDATE to make the trigger act on unintended data.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running PostgreSQL 15 through 18 before the fixed minor releases are exposed. The problem needs a MERGE on a partitioned table that has AFTER triggers, so instances without such triggers or without partitioned MERGE use carry much less risk. PostgreSQL before 15 is not affected.
Not affected if no-after-triggers, no-partitioned-merge, postgresql-before-15
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare the server version with the fixed releases.18.717.1216.1615.20Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.