AZL-113786
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113786.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113786
- Upstream
- CVE-2026-120154
- Published
- 2026-11-12T15:17:44Z
- Modified
- 2026-11-13T14:17:13Z
- Summary
- CVE-2026-120154 affecting package postgresql 16.15-1
- Details
-
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
- References