CVE-2026-120154 PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
Users with INSERT, UPDATE and SELECT privileges can read all rows despite row security policies via iterated INSERT ON CONFLICT DO UPDATE; PostgreSQL admins should care.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- No
- Fix
- Available
What is CVE-2026-120154?
CVE-2026-120154 is a medium-severity security feature bypass vulnerability in PostgreSQL, published on 12 Nov 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Weakness: CWE-424
Which versions are affected by CVE-2026-120154?
Only installations with a non-default setting turned on are exposed.
How do I fix CVE-2026-120154?
Upgrade to a fixed version.
Upgrade to the fixed version, and do not rely on a single control for protection. More about Security feature bypass.
Is CVE-2026-120154 being exploited?
There is no known exploitation of CVE-2026-120154 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-120154, DEBIAN-CVE-2026-120154, ECHO-0278-66ba-eb4e, GHSA-9pxp-38rf-5pgv.