Organization

PostgreSQL

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 3, 2026 · last 11d ago

Timeline2 articles

PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

PostgreSQL flaw CVE-2026-6471, present since 2014, lets low-privilege replication accounts execute code and take over database servers; patches released.

Cyera researchers disclosed PostGREShell (CVE-2026-6471, CVSS 7.2), a missing-authorization bug in PostgreSQL logical decoding that lets users with REPLICATION privilege dlopen arbitrary files and execute code as the server account. The flaw affects PostgreSQL 9.4 through 18 and can yield privilege escalation, permanent superuser access and persistent backdoors on Windows, Linux and macOS. Fixes are available in versions 18.6, 17.11, 16.15, 15.19 and 14.24. Defenders should update and remove unnecessary Replication privileges.

Security AffairsSep 4, 13:41 UTC · 11d agoVulnerability CVE-2026-64711

Decade-old PostgreSQL flaw turns backup account into a backdoor

Cyera disclosed CVE-2026-6471, a decade-old PostgreSQL flaw letting REPLICATION-attribute accounts achieve RCE and superuser compromise, patched August 13.

Cyera Research's 'PostGREShell' flaw exists in PostgreSQL's logical replication output plugin loading, where the replication code path never called the library-path security check, allowing path traversal or UNC paths to load arbitrary code. A low-privilege backup account can achieve code execution on Windows, Linux, and macOS, then escalate to superuser with persistent backdoor access. CVE-2026-6471 affects versions back to PostgreSQL 9.4 (2014) and was patched in releases 18.6, 17.11, 16.15, 15.19, and 14.24 on August 13. CVSS is 7.2, and no exploitation of this specific CVE has been confirmed, though VirusTotal hunting found 114 malicious PostgreSQL plugins.

CSO OnlineSep 3, 11:38 UTC · 12d agoVulnerability CVE-2026-6471

Related CVEsby mentions

CVE-2026-64717.2<1%
Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code
CVE-2026-6471 is a missing-authorization flaw (CWE-862) in PostgreSQL's logical decoding that does not restrict which decoding plugin a replication role may load. An attacker holding a database role with the REPLICATION privilege but without superuser rights can select an arbitrary logical decoding plugin, causing the server to dlopen any file visible to the operating-system account running PostgreSQL and thereby execute arbitrary code as that account. Successful exploitation gives code execution as the PostgreSQL service account (typically the 'postgres' OS user) on the database host, with high impact on confidentiality, integrity, and availability; related reporting indicates the flaw has existed for roughly 12 years and is commonly reached through backup or replication accounts. All deployments on PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected where non-superusers have been granted the REPLICATION privilege. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known; EPSS currently estimates a 0.3% probability of exploitation within the next 30 days.
· PostgreSQL All versions before 18.6 (18.x branch) · PostgreSQL All versions before 17.11 (17.x branch)mass

Appears with

organization Cyera 2 product PostgreSQL 2 vendor PostgreSQL 2 vendor Cyera 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.