CVE-2026-116312: PostgreSQL MERGE can place the wrong row in a trigger transition table
Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL major versions 15 through 18 are affected when running versions earlier than 15.20, 16.16, 17.12, or 18.7. Versions before PostgreSQL 15 are unaffected.
What conditions are required to trigger the issue?
The issue requires a MERGE against a partitioned table that performs an INSERT before an UPDATE, together with an AFTER trigger that uses transition tables. A table data modifier can then cause the trigger to process the wrong new row.
What access does an attacker need?
The severity vector indicates low privileges are required and no user interaction is needed. Exploitation is network-reachable with low attack complexity.
What should be done if immediate patching is not possible?
Avoid or restrict MERGE operations against partitioned tables that perform an INSERT before an UPDATE where affected AFTER triggers use transition tables. Upgrade to PostgreSQL 15.20, 16.16, 17.12, 18.7, or a later applicable release when possible.