POSTGRESQL · CVE-2026-16237 · Package
NO FIX YET · SEE WHAT TO DO
PostgreSQL's INSERT ... ON CONFLICT DO UPDATE on auto-updatable views ignores the view's WHERE condition. A user with INSERT and UPDATE rights on the view can read and modify every row in the underlying base table.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. Exposure requires that a database role holds INSERT and UPDATE privileges on an auto-updatable view; applications without such grants are not reachable this way. Teams that never grant write access through views can deprioritise it.
Not affected if no-view-write-grants, patched-version
Who cares database, postgresql, self-hosted
psql -c "SHOW server_version;" and compare against the fixed versions below.\dv in psql, then check grants with \dp.18.717.1216.16Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
15.2014.25