Quick answers
- Is CVE-2026-16237 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16237 being exploited in the wild.
- How severe is CVE-2026-16237?
- Medium severity, with a CVSS score of 5.4, published 12 November 2026.
- Which products and versions are affected?
- PostgreSQL before 18.7, 17.12, 16.16, 15.20, 14.25.
- Is there a fix for CVE-2026-16237?
- Yes: fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-16237 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-16237?
- Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25
Technical details
The vulnerability exists in PostgreSQL's handling of INSERT ... ON CONFLICT DO UPDATE statements on auto-updatable views. An attacker with INSERT and UPDATE privileges on the view can use repeated INSERT ... ON CONFLICT statements to bypass the view's WHERE condition filters and access or modify rows in the base table that should be restricted. The flaw affects the core server component and requires authentication (PR:L) but no user interaction, with network-accessible attack surface.
Affected products
- PostgreSQL PostgreSQL before 18.7, 17.12, 16.16, 15.20, 14.25
Timeline
- 2026-11-12: disclosed
- 2026-11-12: patched