---
id: "CVE-2026-120154"
page: "https://infrastack.ai/live/CVE-2026-120154"
kind: "vulnerability"
aliases: ["CVE-2026-120154"]
title: "PostgreSQL: INSERT ON CONFLICT lets users read rows despite row security"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["managed-databases", "postgresql", "row-level-security", "runtime", "self-hosted"]
not_affected_if: ["no-row-security-policies", "no-untrusted-db-roles", "patched-version"]
published_at: "2026-11-12T15:17:44+00:00"
first_seen_at: "2026-11-12T15:41:57+00:00"
updated_at: "2026-11-12T15:43:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120154", "first_seen_at": "2026-11-12T15:41:57+00:00"}]
exploit_sources: []
---

# PostgreSQL: INSERT ON CONFLICT lets users read rows despite row security

Link for people: https://infrastack.ai/live/CVE-2026-120154 (this .md is for agents)

An attacker with INSERT, UPDATE and SELECT rights on a table can repeatedly run INSERT ... ON CONFLICT DO UPDATE to read every row, even where row security policies should hide them. The flaw exposes data but does not allow improper writes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the server version with `SELECT version();` and compare it to the fixed versions below.
- Look for tables that use row level security policies and grant INSERT, UPDATE or SELECT to untrusted roles.

## Fix

- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20` and `14.25` or later.

## Timeline

- 2026-11-12T15:41:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120154

## From the sources

Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE.  Unlike CVE-2026-16237, this does not facilitate improper writes.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_