PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostgreSQL flaw CVE-2026-6471, present since 2014, lets low-privilege replication accounts execute code and take over database servers; patches released.
Cyera researchers disclosed PostGREShell (CVE-2026-6471, CVSS 7.2), a missing-authorization bug in PostgreSQL logical decoding that lets users with REPLICATION privilege dlopen arbitrary files and execute code as the server account. The flaw affects PostgreSQL 9.4 through 18 and can yield privilege escalation, permanent superuser access and persistent backdoors on Windows, Linux and macOS. Fixes are available in versions 18.6, 17.11, 16.15, 15.19 and 14.24. Defenders should update and remove unnecessary Replication privileges.
- Bug existed in every PostgreSQL release since 2014 (9.4+)
- Replication accounts can load arbitrary plugins via dlopen()
- Enables RCE, superuser escalation and persistent backdoor access
- Fixed in 18.6, 17.11, 16.15, 15.19 and 14.24
- Review and restrict accounts holding REPLICATION privilege
- CVEs
- CVE-2026-6471
- Vendors
- PostgreSQL
- Products
- PostgreSQL
- Organizations
- PostgreSQLCyera
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-6471 | Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code | 7.2 | <1% |
From the original article
3 min read at securityaffairs.com
PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7. 2).
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.