---
id: "CVE-2026-16237"
page: "https://infrastack.ai/live/CVE-2026-16237"
kind: "vulnerability"
aliases: ["CVE-2026-16237"]
title: "PostgreSQL: INSERT ON CONFLICT on views exposes rows outside view filter"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "PostgreSQL", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["database", "package", "postgresql", "self-hosted"]
not_affected_if: ["no-view-write-grants", "patched-version"]
published_at: "2026-11-12T15:17:50+00:00"
first_seen_at: "2026-11-12T15:41:57+00:00"
updated_at: "2026-11-12T15:43:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16237", "first_seen_at": "2026-11-12T15:41:57+00:00"}]
exploit_sources: []
---

# PostgreSQL: INSERT ON CONFLICT on views exposes rows outside view filter

Link for people: https://infrastack.ai/live/CVE-2026-16237 (this .md is for agents)

PostgreSQL's INSERT ... ON CONFLICT DO UPDATE on auto-updatable views ignores the view's WHERE condition. A user with INSERT and UPDATE rights on the view can read and modify every row in the underlying base table.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:PostgreSQL affected range not listed fixed no fixed version listed

## How to check

- Run `psql -c "SHOW server_version;"` and compare against the fixed versions below.
- List views that users can INSERT and UPDATE through: `\dv` in psql, then check grants with `\dp`.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16237

## From the sources

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE.  This bypasses the view's WHERE condition, whether or not the view is a security_barrier view.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_