Improper Protection in PostgreSQL on Auto-Updatable Views
CVE-2026-16237

5.4MEDIUM

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
12 November 2026

What is CVE-2026-16237?

An improper protection vulnerability in PostgreSQL allows an attacker with INSERT and UPDATE privileges on auto-updatable views to override the view's WHERE conditions. This means they can read and modify any row in the base table of the view by exploiting the INSERT ... ON CONFLICT DO UPDATE feature, effectively bypassing established security measures. This issue affects several versions prior to the latest security updates.

Affected Version(s)

PostgreSQL 18 < 18.7

PostgreSQL 17 < 17.12

PostgreSQL 16 < 16.16

References

https://www.postgresql.org/support/security/CVE-2026-16237/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem.
.