Incorrect authorization in PostgreSQL - CVE-2026-120154

Vulnerability details

The vulnerability allows a remote user to read every row in a table despite row security policies.

The vulnerability exists due to improper enforcement of row security policies in PostgreSQL's INSERT ... ON CONFLICT processing when handling conflicting inserts. A remote user can repeatedly execute INSERT ... ON CONFLICT DO UPDATE statements on a table for which they have INSERT, UPDATE, and applicable SELECT privileges to read rows that row security policies would otherwise restrict.

Affected software

How to mitigate CVE-2026-120154

External References

• https://www.postgresql.org/support/security/CVE-2026-120154/
• https://www.postgresql.org/docs/release/18.7

Related Security Bulletins

• Multiple vulnerabilities in PostgreSQL