CVE-2026-16237: PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a securitybarrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs INSERT and UPDATE privileges on an auto-updatable view. They can then use repeated INSERT ... ON CONFLICT DO UPDATE operations to access or alter rows in the view's underlying base table.
Does a security_barrier view prevent exploitation?
No. The view's WHERE condition can be bypassed whether or not the auto-updatable view is defined with the security_barrier option.
What versions need remediation?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Upgrade to the applicable listed release or later.
What is the impact on affected deployments?
A user with the required privileges can read and modify every row in the view's base table, including rows that the view's WHERE condition should exclude.