PostgreSQL <18.7, <17.12, <16.16, <15.20, <14.25 RLS Bypass via INSERT ON CONFLICT
CVE-2026-120154 Published on November 12, 2026
PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Vulnerability Analysis
Weakness Type
Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
Products Associated with CVE-2026-120154
Want to know whenever a new CVE is published for PostgreSQL? stack.watch will email you.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.