Decade-old PostgreSQL flaw turns backup account into a backdoor

A critical vulnerability in PostgreSQL had remained hidden for more than a decade, potentially turning a routine backup account into a path to full database and server compromise.

The issue, dubbed PostGREShell by Cyera Research, exists in the database’s replication functionality and could allow an attacker with a low-privilege account carrying the REPLICATION attribute to load and execute arbitrary code.

“The flaw lets a low-privilege “backup” account load and execute arbitrary code on the database server, achieving remote code execution across Windows, Linux, and macOS,” said Cyera researcher Vladimir Tokarev in a blog post. “That foothold escalates to full PostgreSQL superuser with persistent backdoor access, turning a routine replication account into total database and server compromise.”

The vulnerability, tracked as CVE-2026-6471, affects PostgreSQL versions dating back to 9.4, released in 2014, and was patched in all supported PostgreSQL releases, including versions 18.6, 17.11, 16.15, 15.19, and 14.24, released on August 13.

While PostgreSQL installations across Windows, Linux, and macOS were affected, the conditions needed to achieve code execution vary by platform, Tokarev noted.

Existing protections were not enough

The problem comes from PostgreSQL’s handling of output plugins used by logical replication. These plugins are compiled code that PostgreSQL loads to format database changes for external systems and tools.

PostgreSQL already has protections designed to stop non-superusers from loading arbitrary libraries from unsafe filesystem locations. Its “check_restricted_library_name()” mechanism restricts where such users can load plugins from, preventing path traversal and absolute paths.

But, according to Cyera, the replication code path never called that security check.

An attacker able to create a logical replication slot could provide a specially crafted plugin name containing filesystem paths, traversal sequences, or, on Windows, UNC paths. PostgreSQL would then pass that name directly to the operating system’s library-loading functions.

When the malicious library was loaded, its initialization code would execute inside the PostgreSQL server process.

The resulting code execution is serious especially because REPLICATION accounts are commonly used as operational plumbing for backups, replicas, change data capture pipelines, migrations, and monitoring.

Cyera said Windows systems are particularly exposed because an attacker could host a malicious DLL on a remote SMB server and point PostgreSQL at it, requiring no prior placement of the malicious file on the target system.

Backup accounts turned into superusers

The problem does not stop at code execution.

Because an output plugin runs inside the PostgreSQL server process, Cyera said malicious code can operate outside the normal SQL permission model. A malicious plugin could manipulate PostgreSQL internals to elevate the attacker’s privileges to superuser and modify internal authentication data.

With superuser access, an attacker could access all databases and their contents, including customer data, application secrets and stored credentials. PostgreSQL superusers can also interact with the underlying operating system, potentially allowing attackers to execute commands, read sensitive files and write data to the server.

Cyera demonstrated multiple persistence mechanisms, including modifications to PostgreSQL authentication configuration and the use of preloaded libraries that could survive database restarts. Tokarev said such access could also be used to gain deeper access into an organization’s environment.

The company reported the issue to the PostgreSQL Security Team in February, which reviewed the findings, assigned the flaw a CVE ID, and released fixes in August.

Though the flaw fell short of a critical CVSS rating at 7.2, Cyera urged customers to patch immediately, noting that PostgreSQL plugins are a popular target for attackers. Its VirusTotal threat hunt found 114 malicious PostgreSQL plugins in the wild, including trojans, cryptocurrency miners, and reverse shells, though the disclosure did not link any of those plugins to the exploitation of CVE-2026-6471.

Outside of patching, users were recommended to audit accounts with the REPLICATION attribute, restrict replication access and block unnecessary outbound SMB and NFS connections from database servers.