# CVE-2026-16237: PostgreSQL INSERT ON CONFLICT authorization bypass on auto-updatable views

Source: https://junglewise.ai/threats/cve-2026-16237-improper-protection-in-postgresql-insert-on-conflict-on-auto  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-16237 · Severity: medium · CVSS 5.4 · Published 2026-11-12

PostgreSQL is a widely used open-source relational database system. This vulnerability allows an attacker with basic INSERT and UPDATE permissions on a view to circumvent the view's security filters and access or modify every row in the underlying table. This bypasses intentional data restrictions, even on views marked as security barriers, potentially exposing sensitive data or enabling unauthorized modifications.

Technologies: [PostgreSQL](https://junglewise.ai/threats/technologies/postgresql). Vendors: [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql).

## Quick answers

**Is CVE-2026-16237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16237 being exploited in the wild.

**How severe is CVE-2026-16237?** Medium severity, with a CVSS score of 5.4, published 12 November 2026.

**Which products and versions are affected?** PostgreSQL before 18.7, 17.12, 16.16, 15.20, 14.25.

**Is there a fix for CVE-2026-16237?** Yes: fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16237 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16237?** Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25

## Technical details

The vulnerability exists in PostgreSQL's handling of INSERT ... ON CONFLICT DO UPDATE statements on auto-updatable views. An attacker with INSERT and UPDATE privileges on the view can use repeated INSERT ... ON CONFLICT statements to bypass the view's WHERE condition filters and access or modify rows in the base table that should be restricted. The flaw affects the core server component and requires authentication (PR:L) but no user interaction, with network-accessible attack surface.

## Affected products

- PostgreSQL PostgreSQL before 18.7, 17.12, 16.16, 15.20, 14.25

## Timeline

- 2026-11-12: disclosed
- 2026-11-12: patched

## References

- [https://www.postgresql.org/support/security/CVE-2026-16237/](https://www.postgresql.org/support/security/CVE-2026-16237/)

## Related threats

- [PostgreSQL CREATE EXTENSION arbitrary SQL execution](https://junglewise.ai/threats/cve-2026-6467-uncontrolled-search-path-element-in-postgresql-create-extension)
- [PostgreSQL type confusion in ALTER allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-6460-type-confusion-in-postgresql-allows-an-object-creator-to-execute)
- [PostgreSQL type confusion in SQL-language functions arbitrary code execution](https://junglewise.ai/threats/cve-2026-18447-type-confusion-in-postgresql-sql-language-functions-allows-an)
- [PostgreSQL dblink and subscriptions arbitrary file append](https://junglewise.ai/threats/cve-2026-14661-external-control-of-file-name-in-postgresql-dblink-and-create)
- [PostgreSQL INSERT ... ON CONFLICT row security bypass](https://junglewise.ai/threats/cve-2026-120154-improper-protection-in-postgresql-insert-on-conflict-allows-an)