CVE-2023-39418: Postgresql: merge fails to enforce update or select row security policies

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-11 · updated 2026-06-17
Weakness: CWE-1220

Description

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Affected products

Debian Linux: 12.0
PostgreSQL: from 15.0 before 15.4 — fixed in 15.4
Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: PostgreSQL 15.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2023:7785
https://access.redhat.com/errata/RHSA-2023:7883
https://access.redhat.com/errata/RHSA-2023:7884
https://access.redhat.com/errata/RHSA-2023:7885
https://access.redhat.com/security/cve/CVE-2023-39418
https://bugzilla.redhat.com/show_bug.cgi?id=2228112
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229
https://www.postgresql.org/support/security/CVE-2023-39418/
https://access.redhat.com/errata/RHSA-2023:7785
https://access.redhat.com/errata/RHSA-2023:7883
https://access.redhat.com/errata/RHSA-2023:7884
https://access.redhat.com/errata/RHSA-2023:7885

Get alerted when CVE-2023-39418 or the next vulnerability affects your stack