{"id":"CVE-2026-16237","kind":"vulnerability","aliases":["CVE-2026-16237"],"related":[],"title":"PostgreSQL: INSERT ON CONFLICT on views exposes rows outside view filter","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE.  This bypasses the view's WHERE condition, whether or not the view is a security_barrier view.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's INSERT ... ON CONFLICT DO UPDATE on auto-updatable views ignores the view's WHERE condition. A user with INSERT and UPDATE rights on the view can read and modify every row in the underlying base table.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PostgreSQL","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["database","package","postgresql","self-hosted"],"not_affected_if":["no-view-write-grants","patched-version"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare against the fixed versions below.\n- List views that users can INSERT and UPDATE through: `\\dv` in psql, then check grants with `\\dp`.","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:50+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","triaged_at":"2026-11-12T15:43:53+00:00","updated_at":"2026-11-12T15:43:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T15:43:53Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: INSERT ON CONFLICT on views exposes rows outside view filter","impact":"high","summary":"PostgreSQL's INSERT ... ON CONFLICT DO UPDATE on auto-updatable views ignores the view's WHERE condition. A user with INSERT and UPDATE rights on the view can read and modify every row in the underlying base table.","audience":"businesses","category":"package","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated database user reads and modifies all base table rows","analyst_note":"","how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare against the fixed versions below.\n- List views that users can INSERT and UPDATE through: `\\dv` in psql, then check grants with `\\dp`.\n- unknown whether other configuration changes exposure.","plain_action":"","product_name":"PostgreSQL","needs_analyst":false,"not_affected_if":["patched-version","no-view-write-grants"],"who_is_affected":"Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. Exposure requires that a database role holds INSERT and UPDATE privileges on an auto-updatable view; applications without such grants are not reachable this way. Teams that never grant write access through views can deprioritise it.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4604,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16237':14A,17A '-2026':13A,16A '14.25':131C '15.20':129C '16.16':128C '17.12':127C '18.7':126C 'affect':133C 'allow':76C 'attack':78C 'auto':34B,73C 'auto-updat':33B,72C 'barrier':121C 'base':62B,97C 'bypass':107C 'condit':42B,112C 'conflict':4A,29B,70C,103C 'cve':12A,15A 'databas':19B 'everi':57B,91C 'expos':7A 'filter':11A 'host':24B 'ignor':37B 'improp':64C 'insert':2A,27B,46B,68C,80C,101C 'iter':100C 'modifi':56B,90C 'outsid':9A 'packag':20B 'postgresql':1A,18A,21B,25B,67C,125C 'privileg':83C 'protect':65C 'read':54B,88C 'right':49B 'row':8A,58B,92C 'secur':120C 'self':23B 'self-host':22B 'tabl':63B,98C 'under':61B 'updat':31B,35B,48B,74C,82C,105C 'user':44B 'version':123C 'via':99C 'view':6A,10A,36B,39B,52B,75C,86C,95C,109C,117C,122C 'whether':113C","nicknames":[],"mitigations":[],"who_affected":"Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. Exposure requires that a database role holds INSERT and UPDATE privileges on an auto-updatable view; applications without such grants are not reachable this way. Teams that never grant write access through views can deprioritise it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["postgresql"],"ptokens":["postgresql"],"labels":["database","medium","package","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-16237':14A,17A '-2026':13A,16A 'conflict':4A 'cve':12A,15A 'expos':7A 'filter':11A 'insert':2A 'outsid':9A 'postgresql':1A,18A 'row':8A 'view':6A,10A","search_b":"'auto':34B 'auto-updat':33B 'base':62B 'condit':42B 'conflict':29B 'databas':19B 'everi':57B 'host':24B 'ignor':37B 'insert':27B,46B 'modifi':56B 'packag':20B 'postgresql':21B,25B 'read':54B 'right':49B 'row':58B 'self':23B 'self-host':22B 'tabl':63B 'under':61B 'updat':31B,35B,48B 'user':44B 'view':36B,39B,52B","search_c":"'14.25':131C '15.20':129C '16.16':128C '17.12':127C '18.7':126C 'affect':133C 'allow':76C 'attack':78C 'auto':73C 'auto-updat':72C 'barrier':121C 'base':97C 'bypass':107C 'condit':112C 'conflict':70C,103C 'everi':91C 'improp':64C 'insert':68C,80C,101C 'iter':100C 'modifi':90C 'postgresql':67C,125C 'privileg':83C 'protect':65C 'read':88C 'row':92C 'secur':120C 'tabl':98C 'updat':74C,82C,105C 'version':123C 'via':99C 'view':75C,86C,95C,109C,117C,122C 'whether':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16237","severity":null,"published_at":"2026-11-12T15:17:50+00:00","modified_at":"2026-11-12T15:17:50+00:00","first_seen_at":"2026-11-12T15:41:57+00:00","fetched_at":"2026-11-12T15:41:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}