PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.
PostgreSQL patched CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding shipped in 9.4 (2014) that lets an account with the REPLICATION attribute run arbitrary code as the database server's OS user when wal_level is logical. Versions before 18.6, 17.11, 16.15, 15.19, and 14.24 are affected; exploitation requires such an account, which backup, CDC, and monitoring tooling routinely holds. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating. Cyera Research, whose write-up names the flaw PostGREShell, demonstrated escalating a replication user to superuser with persistence; no PoC or KEV entry existed as of September 4.
- CVE-2026-6471 (CVSS 7.2) lets REPLICATION-attribute accounts execute code as the postgres OS user
- Flaw present since 2014; fixed in 18.6, 17.11, 16.15, 15.19, and 14.24
- Requires wal_level=logical; backup, CDC, and monitoring credentials often carry REPLICATION
- New output_plugin_libraries whitelist means wal2json/decoderbufs users must reconfigure post-update
- Cyera demo escalated to superuser with persistence; no PoC or KEV listing as of Sept 4
- CVEs
- CVE-2026-6471
- Vendors
- PostgreSQLCyera
- Products
- PostgreSQL
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-6471 | Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code | 7.2 | <1% |
From the original article
4 min read at thehackernews.com
PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. The flaw, tracked as CVE-2026-6471 (CVSS score: 7. 2), has been present since logical decoding was introduced in PostgreSQL 9.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.