Decade-old PostgreSQL flaw turns backup account into a backdoor
Cyera disclosed CVE-2026-6471, a decade-old PostgreSQL flaw letting REPLICATION-attribute accounts achieve RCE and superuser compromise, patched August 13.
Cyera Research's 'PostGREShell' flaw exists in PostgreSQL's logical replication output plugin loading, where the replication code path never called the library-path security check, allowing path traversal or UNC paths to load arbitrary code. A low-privilege backup account can achieve code execution on Windows, Linux, and macOS, then escalate to superuser with persistent backdoor access. CVE-2026-6471 affects versions back to PostgreSQL 9.4 (2014) and was patched in releases 18.6, 17.11, 16.15, 15.19, and 14.24 on August 13. CVSS is 7.2, and no exploitation of this specific CVE has been confirmed, though VirusTotal hunting found 114 malicious PostgreSQL plugins.
- Replication code path skips check_restricted_library_name(), enabling path traversal in plugin names
- Code execution escalates to superuser with persistence via auth config and preloaded libraries
- Windows hosts especially exposed via malicious DLLs on remote SMB servers
- Patched in all supported branches including 18.6 and 14.24 on August 13, 2026
- VirusTotal hunt found 114 malicious PostgreSQL plugins, though none tied to CVE-2026-6471
- CVEs
- CVE-2026-6471
- Tags
- cve-2026-6471database-securitylogical-replicationpatchpostgresqlprivilege-escalationremote-code-execution
- Vendors
- PostgreSQLCyera
- Products
- PostgreSQL
- Organizations
- PostgreSQLCyera
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-6471 | Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code | 7.2 | <1% |
From the original article
3 min read at csoonline.com
A critical vulnerability in PostgreSQL had remained hidden for more than a decade, potentially turning a routine backup account into a path to full database and server compromise. The issue, dubbed PostGREShell by Cyera Research, exists in the database’s replication functionality and could allow an attacker with a low-privilege account carrying the REPLICATION attribute to load and execute arbitrary code.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.