ALPINE-CVE-2026-120154: Medium severity alpine/postgresql15 vulnerability
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using PostgreSQL 14 before 14.25, 15 before 15.20, 16 before 16.16, 17 before 17.12, or 18 before 18.7 are affected. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What privileges does an attacker need?
An attacker needs INSERT and UPDATE privileges on the affected table, plus applicable SELECT privileges. Exploitation uses repeated INSERT ... ON CONFLICT DO UPDATE statements.
What is the impact of successful exploitation?
A successful attacker can read every row in the affected table despite row security policies. The issue does not allow improper writes.
How can exposure be reduced before upgrading?
Restrict INSERT, UPDATE, and applicable SELECT privileges on tables protected by row security policies, particularly for roles that do not need all three permissions. This prevents the stated privilege combination required for exploitation.