---
id: CVE-2023-39418
title: 'Postgresql: merge fails to enforce update or select row security policies'
summary: >-
  A vulnerability was found in PostgreSQL with the use of the MERGE command,
  which fails to test new rows against row security policies defined for UPDATE
  and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT
  policies do n…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-1220
vendor: Red Hat
product: 'postgresql:15'
affected:
  - 'postgresql:15 (all versions)'
  - 'postgresql:15 (all versions)'
  - 'postgresql:15 (all versions)'
  - 'postgresql:15 (all versions)'
  - postgresql
  - postgresql
  - 'postgresql:10/postgresql'
  - 'postgresql:12/postgresql'
  - 'postgresql:13/postgresql'
  - postgresql
  - rh-postgresql10-postgresql
  - rh-postgresql12-postgresql
  - rh-postgresql13-postgresql
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2023-12-19T19:31:10.818251Z'
published: '2023-08-11'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T11:56:12.771Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-39418'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:7785'
    label: 'RHSA-2023:7785'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7883'
    label: 'RHSA-2023:7883'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7884'
    label: 'RHSA-2023:7884'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7885'
    label: 'RHSA-2023:7885'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-39418'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2228112'
    label: RHBZ#2228112
  - url: >-
      https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=cb2ae5741f2458a474ed3c31458d242e678ff229
  - url: 'https://www.postgresql.org/support/security/CVE-2023-39418/'
tags:
  - cve.org
epss: 0.01086
epssPercentile: 0.65489
ingestedAt: '2026-11-07T12:16:41.100Z'
---

## Overview

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

## Affected

- `postgresql:15 (all versions)`
- `postgresql:15 (all versions)`
- `postgresql:15 (all versions)`
- `postgresql:15 (all versions)`
- `postgresql`
- `postgresql`
- `postgresql:10/postgresql`
- `postgresql:12/postgresql`
- `postgresql:13/postgresql`
- `postgresql`
- `rh-postgresql10-postgresql`
- `rh-postgresql12-postgresql`
- `rh-postgresql13-postgresql`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.