{"id":"CVE-2026-120154","kind":"vulnerability","aliases":["CVE-2026-120154"],"related":[],"title":"PostgreSQL: INSERT ON CONFLICT lets users read rows despite row security","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE.  Unlike CVE-2026-16237, this does not facilitate improper writes.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"An attacker with INSERT, UPDATE and SELECT rights on a table can repeatedly run INSERT ... ON CONFLICT DO UPDATE to read every row, even where row security policies should hide them. The flaw exposes data but does not allow improper writes.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["managed-databases","postgresql","row-level-security","runtime","self-hosted"],"not_affected_if":["no-row-security-policies","no-untrusted-db-roles","patched-version"],"how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed versions below.\n- Look for tables that use row level security policies and grant INSERT, UPDATE or SELECT to untrusted roles.","fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20` and `14.25` or later.","status":"open","published_at":"2026-11-12T15:17:44+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","triaged_at":"2026-11-12T15:43:58+00:00","updated_at":"2026-11-12T15:43:58+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:58Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20` and `14.25` or later.","reach":"network","title":"PostgreSQL: INSERT ON CONFLICT lets users read rows despite row security","impact":"medium","summary":"An attacker with INSERT, UPDATE and SELECT rights on a table can repeatedly run INSERT ... ON CONFLICT DO UPDATE to read every row, even where row security policies should hide them. The flaw exposes data but does not allow improper writes.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","row-level-security","self-hosted","managed-databases"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"database role reads rows hidden by row security policies","analyst_note":"","how_to_check":"- Check the server version with `SELECT version();` and compare it to the fixed versions below.\n- Look for tables that use row level security policies and grant INSERT, UPDATE or SELECT to untrusted roles.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-row-security-policies","no-untrusted-db-roles","patched-version"],"who_is_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 that use row security policies on tables. Exposure needs a database role with INSERT, UPDATE and applicable SELECT on the table. Systems without row level security or without such roles are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4598,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120154':14A,17A '-16237':109C '-2026':13A,16A,108C '14.25':124C '15.20':122C '16.16':121C '17.12':120C '18.7':119C 'affect':126C 'allow':68B,78C 'applic':85C 'attack':31B,80C 'conflict':4A,46B,77C,103C 'cve':12A,15A,107C 'data':64B 'databas':20B 'despit':9A,95C 'even':53B 'everi':51B,93C 'expos':63B 'facilit':113C 'flaw':62B 'hide':59B 'host':29B 'improp':69B,71C,114C 'insert':2A,33B,44B,75C,82C,101C 'iter':100C 'let':5A 'level':24B 'manag':19B 'managed-databas':18B 'polici':57B,98C 'postgresql':1A,21B,74C,118C 'privileg':87C 'protect':72C 'read':7A,50B,92C 'repeat':42B 'right':37B 'row':8A,10A,23B,52B,55B,94C,96C 'row-level-secur':22B 'run':43B 'runtim':26B 'secur':11A,25B,56B,97C 'select':36B,86C 'self':28B 'self-host':27B 'tabl':40B,90C 'unlik':106C 'updat':34B,48B,83C,105C 'user':6A 'version':116C 'via':99C 'write':70B,115C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 that use row security policies on tables. Exposure needs a database role with INSERT, UPDATE and applicable SELECT on the table. Systems without row level security or without such roles are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["manageddatabases","medium","postgresql","rowlevelsecurity","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120154':14A,17A '-2026':13A,16A 'conflict':4A 'cve':12A,15A 'despit':9A 'insert':2A 'let':5A 'postgresql':1A 'read':7A 'row':8A,10A 'secur':11A 'user':6A","search_b":"'allow':68B 'attack':31B 'conflict':46B 'data':64B 'databas':20B 'even':53B 'everi':51B 'expos':63B 'flaw':62B 'hide':59B 'host':29B 'improp':69B 'insert':33B,44B 'level':24B 'manag':19B 'managed-databas':18B 'polici':57B 'postgresql':21B 'read':50B 'repeat':42B 'right':37B 'row':23B,52B,55B 'row-level-secur':22B 'run':43B 'runtim':26B 'secur':25B,56B 'select':36B 'self':28B 'self-host':27B 'tabl':40B 'updat':34B,48B 'write':70B","search_c":"'-16237':109C '-2026':108C '14.25':124C '15.20':122C '16.16':121C '17.12':120C '18.7':119C 'affect':126C 'allow':78C 'applic':85C 'attack':80C 'conflict':77C,103C 'cve':107C 'despit':95C 'everi':93C 'facilit':113C 'improp':71C,114C 'insert':75C,82C,101C 'iter':100C 'polici':98C 'postgresql':74C,118C 'privileg':87C 'protect':72C 'read':92C 'row':94C,96C 'secur':97C 'select':86C 'tabl':90C 'unlik':106C 'updat':83C,105C 'version':116C 'via':99C 'write':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120154","severity":null,"published_at":"2026-11-12T15:17:44+00:00","modified_at":"2026-11-12T15:17:44+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","fetched_at":"2026-11-12T15:41:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}