CVE-2026-16237

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16237", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-07-20T01:55:06.428Z", "datePublished": "2026-11-12T14:15:30.710Z", "dateUpdated": "2026-11-12T21:42:02.923Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-12T14:15:30.710Z"}, "title": "PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition", "x_postgresql": {"component": "core server"}, "descriptions": [{"lang": "en", "value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-424", "type": "CWE", "description": "Improper Protection of Alternate Path"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-16237/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "configurations": [{"lang": "en", "value": "attacker has INSERT and UPDATE privileges on an auto-updatable view but lacks one of those on its base table"}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-12T21:10:19.107281Z", "id": "CVE-2026-16237", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-12T21:42:02.923Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.7", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.12", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.16", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.20", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.25", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}], "id": "CVE-2026-16237", "lastModified": "2026-11-12T22:19:21.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16237", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-12T21:10:19.107281Z", "version": "2.0.3"}}]}, "published": "2026-11-12T15:17:50.030", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2026-16237/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-424"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: postgresql: Security restriction bypass via INSERT ON CONFLICT on auto-updatable views", "id": "2572574", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572574"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in PostgreSQL. When handling conflict-resolving insert statements (INSERT ... ON CONFLICT) on auto-updatable views, the database fails to properly enforce view boundary restrictions. An authenticated attacker with insert and update privileges on a view can exploit this vulnerability through repeated queries to bypass filtering conditions, allowing them to read and modify unauthorized rows in the underlying base table."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-16237", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libpq", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql17", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-12T14:15:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16237\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16237\nhttps://www.postgresql.org/support/security/CVE-2026-16237/"], "statement": "This vulnerability is rated as Moderate severity rather than Important because exploitation requires an authenticated attacker who already possesses both insert and modification permissions on a targeted view, limiting the blast radius to environments where auto-updatable views are relied upon as security boundaries. In typical Red Hat Enterprise Linux deployments, PostgreSQL views are not automatically configured with partitioned row-level boundaries, and administrative access is needed to grant the necessary write rights. While security_barrier views are bypassed by this defect when conflict handling queries are repeatedly executed, attackers cannot gain broader system access or affect schemas outside their granted database privileges.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.25)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-11-13T04:15:14.472438+00:00", "updated": "2026-11-13T04:15:14.472455+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}