CVE-2026-120154 · Runtime
NO FIX YET · SEE WHAT TO DO
An attacker with INSERT, UPDATE and SELECT rights on a table can repeatedly run INSERT ... ON CONFLICT DO UPDATE to read every row, even where row security policies should hide them. The flaw exposes data but does not allow improper writes.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 that use row security policies on tables. Exposure needs a database role with INSERT, UPDATE and applicable SELECT on the table. Systems without row level security or without such roles are less exposed.
Not affected if no-row-security-policies, no-untrusted-db-roles, patched-version
Who cares managed-databases, postgresql, row-level-security, self-hosted
SELECT version(); and compare it to the fixed versions below.18.7, 17.12, 16.16, 15.20 and 14.25 or later.Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.