CVE-2026-120154: PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected when row security policies are relied upon to restrict visibility of rows in a table.
What access does an attacker need?
The attacker needs INSERT, UPDATE, and applicable SELECT privileges on the affected table. They can use iterated INSERT ... ON CONFLICT DO UPDATE operations to read rows that row security policies should prevent them from seeing.
Does this issue allow unauthorized modification of protected rows?
No. This issue permits improper reads despite row security policies, but does not facilitate improper writes.
How can the issue be remediated?
Upgrade PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, as applicable to the major version in use.