AZL-113792: CVE-2026-16237 affecting package postgresql 16.15-1

Q: Who is realistically exposed to this issue?

Deployments are exposed when users have both INSERT and UPDATE privileges on an auto-updatable view that restricts rows with a WHERE condition. Those users can bypass that condition to read and modify rows in the underlying base table.

Q: Does using a security_barrier view prevent exploitation?

No. The bypass applies whether or not the affected view is configured as a security_barrier view.

Q: What does an attacker need to exploit it?

The attacker needs INSERT and UPDATE privileges on the affected auto-updatable view. Exploitation uses repeated INSERT ... ON CONFLICT DO UPDATE statements.

Q: Which PostgreSQL releases address the issue?

The issue affects versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed package version, postgresql 16.15-1, is below the fixed 16.16 release.

Published Nov 12, 2026

Updated

Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a securitybarrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

1 affected component

azure-linux/postgresql<=16.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16

Event History

Nov 12, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-16237

Frequently Asked Questions

Who is realistically exposed to this issue?

Deployments are exposed when users have both INSERT and UPDATE privileges on an auto-updatable view that restricts rows with a WHERE condition. Those users can bypass that condition to read and modify rows in the underlying base table.

Does using a security_barrier view prevent exploitation?

No. The bypass applies whether or not the affected view is configured as a security_barrier view.

What does an attacker need to exploit it?

The attacker needs INSERT and UPDATE privileges on the affected auto-updatable view. Exploitation uses repeated INSERT ... ON CONFLICT DO UPDATE statements.

Which PostgreSQL releases address the issue?

The issue affects versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed package version, postgresql 16.15-1, is below the fixed 16.16 release.

AZL-113792: CVE-2026-16237 affecting package postgresql 16.15-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

Does using a security_barrier view prevent exploitation?

What does an attacker need to exploit it?

Which PostgreSQL releases address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

Does using a security_barrier view prevent exploitation?

What does an attacker need to exploit it?

Which PostgreSQL releases address the issue?