UBUNTU-CVE-2026-16237: Medium severity ubuntu/postgresql-9.3 vulnerability
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a securitybarrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when an auto-updatable view has a WHERE condition and a user has both INSERT and UPDATE privileges on that view. The issue affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.
What access does an attacker need?
An attacker needs INSERT and UPDATE privileges on the affected view. They can use iterated INSERT ... ON CONFLICT DO UPDATE operations to read and modify rows in the underlying base table that the view's WHERE condition should restrict.
Does marking the view as security_barrier prevent exploitation?
No. The described bypass applies whether or not the affected view is configured as a security_barrier view.
How can administrators identify potentially affected configurations?
Identify auto-updatable views with WHERE conditions, then review which roles have both INSERT and UPDATE privileges on those views. Systems running releases earlier than the listed fixed versions should be assessed for those privilege and view combinations.