PostgreSQL patches 'PostGREShell' (CVE-2026-6471, CVSS 7.2), a 2014-era flaw letting replication accounts execute code and take over servers
CVE-2026-6471, present since PostgreSQL 9.4 shipped logical decoding in 2014, lets any account with the REPLICATION attribute execute arbitrary code as the database OS user and escalate to superuser with persistent backdoor access; it was patched August 13,…
Cyera Research disclosed CVE-2026-6471 (CVSS 7.2), a vulnerability in PostgreSQL's logical replication output plugin loading that the researchers dubbed PostGREShell. The replication code path never called the library-path security check check_restricted_library_name(), so a plugin name using path traversal or UNC paths could load arbitrary code; Security Affairs characterizes the bug as missing authorization that lets replication accounts dlopen() arbitrary files. The Hacker News adds that exploitation requires wal_level=logical. An account with the REPLICATION attribute - routinely held by backup, CDC, and monitoring tooling - can achieve code execution as the database server's OS user on Windows, Linux, and macOS, then escalate to superuser with persistent backdoor access via auth configuration and preloaded libraries; CSO Online notes Windows hosts are especially exposed to malicious DLLs on remote SMB servers. The flaw dates to logical decoding's debut in PostgreSQL 9.4 (2014) and, per Security Affairs, affects releases from 9.4 through 18; CSO Online characterized it as a decade-old flaw while Security Affairs and The Hacker News called it 12-year-old, both anchoring it to 2014. It was fixed in releases 18.6, 17.11, 16.15, 15.19, and 14.24, published August 13, 2026. The fix adds an output_plugin_libraries whitelist, so administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating; Security Affairs also advises reviewing and restricting accounts holding the REPLICATION privilege. No exploitation of this specific CVE has been confirmed, and there was no PoC or KEV entry as of September 4, 2026; VirusTotal hunting found 114 malicious PostgreSQL plugins, though none tied to CVE-2026-6471.
- CVE-2026-6471 (CVSS 7.2), nicknamed PostGREShell by Cyera Research, is a flaw in PostgreSQL's logical replication output plugin loading.
- The replication code path skips the library-path security check check_restricted_library_name(), allowing plugin names with path traversal or UNC paths to load arbitrary code; Security Affairs describes it as a missing-authorization bug…
- Exploitation requires wal_level=logical (per The Hacker News) and an account with the REPLICATION attribute, which backup, CDC, and monitoring tooling routinely holds.
- Impact: arbitrary code execution as the database server's OS user on Windows, Linux, and macOS, escalating to superuser with persistent backdoor access via auth configuration and preloaded libraries.
- Windows hosts are especially exposed via malicious DLLs on remote SMB servers (CSO Online).
- The flaw is present in every PostgreSQL release since 9.4 (2014); Security Affairs puts the affected range at 9.4 through 18.
- Age attribution differs: CSO Online called it a decade-old flaw, while Security Affairs and The Hacker News called it 12-year-old; both anchor it to logical decoding's 2014 debut.
- Fixed in releases 18.6, 17.11, 16.15, 15.19, and 14.24, published August 13, 2026.
Coverage timelineoldest first · each row is one article
- · 13d agoDecade-old PostgreSQL flaw turns backup account into a backdoor
CSO Online· 65
Cyera disclosed CVE-2026-6471, a decade-old PostgreSQL flaw letting REPLICATION-attribute accounts achieve RCE and superuser compromise, patched August 13.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-6471 | Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code CVE-2026-6471 is a missing-authorization flaw (CWE-862) in PostgreSQL's logical decoding that does not restrict which decoding plugin a replication role may load. An attacker holding a database role with the REPLICATION privilege but without superuser rights can select an arbitrary logical decoding plugin, causing the server to dlopen any file visible to the operating-system account running PostgreSQL and thereby execute arbitrary code as that account. Successful exploitation gives code execution as the PostgreSQL service account (typically the 'postgres' OS user) on the database host, with high impact on confidentiality, integrity, and availability; related reporting indicates the flaw has existed for roughly 12 years and is commonly reached through backup or replication accounts. All deployments on PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected where non-superusers have been granted the REPLICATION privilege. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known; EPSS currently estimates a 0.3% probability of exploitation within the next 30 days. Do: Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 depending on the branch in use. As interim mitigation, audit all roles holding the REPLICATION privilege, revoke it from users who do not need replication or logical decoding, and restrict which decoding plugins may be selected. Pay particular attention to backup and replication service accounts, which related reporting highlights as the likely abuse path. | 7.2 | <1% |
| massmillions of installations (PostgreSQL is deployed across millions of on-prem and managed-cloud database instances, though only hosts granting REPLICATION to… |