DEBIAN-CVE-2026-120154: Medium severity debian/postgresql-15 vulnerability
Published Nov 12, 2026
·Updated
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
3 affected componentsFixes available
debian/postgresql-15*
debian/postgresql-17<17.12-0+deb13u1
17.12-0+deb13u1
debian/postgresql-18*
Event History
Nov 12, 2026
CVE Published
via OSV·03:17 PM
Data Sourced
via OSV·03:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What level of access does an attacker need?
The attack vector is network-based and requires low privileges. No user interaction is required.
2
What is the expected security impact?
The reported impact is limited confidentiality impact. Integrity and availability impact are listed as none.
3
Which Debian package deployments should be evaluated?
Evaluate deployments using debian/postgresql-15, debian/postgresql-17, or debian/postgresql-18.