Story · 1 source · 1 articlefirst Sep 4, 13:41 UTCupdated Sep 4, 13:41 UTC (11d ago)

PostgreSQL Patches 12-Year-Old 'PostGREShell' Flaw (CVE-2026-6471) Letting Replication Accounts Execute Code and Take Over Servers

highVulnerabilityimportance 68CVE-2026-6471

What's new: Initial merged summary (no previous story). Both September 4, 2026 reports (Security Affairs 13:41Z, The Hacker News 15:20Z) agree on CVE-2026-6471 (CVSS 7.2), the 2014/9.4 origin, REPLICATION-role code execution, superuser escalation with persistence, and fixed versions 18.6/17.11/16.15/15.19/14.24. The Hacker News adds the wal_level=logical precondition, the new output_plugin_libraries…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

PostgreSQL patched CVE-2026-6471 (CVSS 7.2), dubbed 'PostGREShell' by Cyera Research — a missing-authorization flaw in logical decoding, present since 9.4 (2014), that lets REPLICATION-attribute accounts dlopen arbitrary files and execute code as the database…

Cyera researchers disclosed 'PostGREShell' (CVE-2026-6471, CVSS 7.2), a missing-authorization bug in PostgreSQL logical decoding that has existed in every release since logical decoding shipped in PostgreSQL 9.4 in 2014, affecting versions 9.4 through 18. An account holding the REPLICATION attribute can exploit the flaw when wal_level is logical to dlopen arbitrary files and execute code as the database server's OS user, enabling privilege escalation, permanent superuser access, and persistent backdoors; per Security Affairs the impact spans Windows, Linux, and macOS. Fixes are available in versions 18.6, 17.11, 16.15, 15.19, and 14.24. The fix introduces an output_plugin_libraries whitelist, so administrators using non-default logical decoding plugins such as wal2json or decoderbufs must add them and reload configuration after updating. Exploitation requires a replication-privileged account, which backup, CDC, and monitoring tooling routinely holds; no public PoC or KEV entry existed as of September 4, 2026. Defenders should update and review/restrict accounts holding the REPLICATION privilege.

CVE-2026-6471 (CVSS 7.2), named 'PostGREShell' by Cyera Research, is a missing-authorization flaw in PostgreSQL logical decoding.
The flaw has been present in every PostgreSQL release since logical decoding shipped in 9.4 (2014); affected versions span 9.4 through 18.
Exploitation requires an account with the REPLICATION attribute and wal_level=logical.
Replication accounts can dlopen arbitrary files and execute code as the database server's OS user (the postgres OS user).
Cyera demonstrated escalating a replication user to superuser with persistence, including permanent superuser access and persistent backdoors.
Impact is cross-platform on Windows, Linux, and macOS (per Security Affairs).
Fixed in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24.
The fix adds an output_plugin_libraries whitelist; administrators using non-default plugins such as wal2json and decoderbufs must add them and reload configuration after updating.

VendorsPostgreSQL Cyera

ProductsPostgreSQL

OrganizationsPostgreSQL Cyera

Coverage timelineoldest first · each row is one article

Sep 4, 13:41 UTC · 11d ago
Security Affairs· 68
PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostgreSQL flaw CVE-2026-6471, present since 2014, lets low-privilege replication accounts execute code and take over database servers; patches released.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-6471	Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code CVE-2026-6471 is a missing-authorization flaw (CWE-862) in PostgreSQL's logical decoding that does not restrict which decoding plugin a replication role may load. An attacker holding a database role with the REPLICATION privilege but without superuser rights can select an arbitrary logical decoding plugin, causing the server to dlopen any file visible to the operating-system account running PostgreSQL and thereby execute arbitrary code as that account. Successful exploitation gives code execution as the PostgreSQL service account (typically the 'postgres' OS user) on the database host, with high impact on confidentiality, integrity, and availability; related reporting indicates the flaw has existed for roughly 12 years and is commonly reached through backup or replication accounts. All deployments on PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected where non-superusers have been granted the REPLICATION privilege. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known; EPSS currently estimates a 0.3% probability of exploitation within the next 30 days. Do: Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 depending on the branch in use. As interim mitigation, audit all roles holding the REPLICATION privilege, revoke it from users who do not need replication or logical decoding, and restrict which decoding plugins may be selected. Pay particular attention to backup and replication service accounts, which related reporting highlights as the likely abuse path.	7.2	<1%		PostgreSQL All versions before 18.6 (18.x branch) PostgreSQL All versions before 17.11 (17.x branch) PostgreSQL All versions before 16.15 (16.x branch) +2 more	massmillions of installations (PostgreSQL is deployed across millions of on-prem and managed-cloud database instances, though only hosts granting REPLICATION to…	Aug 13, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-6471

Missing Authorization in PostgreSQL Logical Decoding Lets REPLICATION Role Run Code

CVE-2026-6471 is a missing-authorization flaw (CWE-862) in PostgreSQL's logical decoding that does not restrict which decoding plugin a replication role may load. An attacker holding a database role with the REPLICATION privilege but without superuser rights can select an arbitrary logical decoding plugin, causing the server to dlopen any file visible to the operating-system account running PostgreSQL and thereby execute arbitrary code as that account. Successful exploitation gives code execution as the PostgreSQL service account (typically the 'postgres' OS user) on the database host, with high impact on confidentiality, integrity, and availability; related reporting indicates the flaw has existed for roughly 12 years and is commonly reached through backup or replication accounts. All deployments on PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected where non-superusers have been granted the REPLICATION privilege. No exploitation in the wild, public proof-of-concept, or CISA KEV listing is known; EPSS currently estimates a 0.3% probability of exploitation within the next 30 days.

Do: Upgrade to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 depending on the branch in use. As interim mitigation, audit all roles holding the REPLICATION privilege, revoke it from users who do not need replication or logical decoding, and restrict which decoding plugins may be selected. Pay particular attention to backup and replication service accounts, which related reporting highlights as the likely abuse path.

7.2

<1%

PostgreSQL All versions before 18.6 (18.x branch)
PostgreSQL All versions before 17.11 (17.x branch)
PostgreSQL All versions before 16.15 (16.x branch)
+2 more

massmillions of installations (PostgreSQL is deployed across millions of on-prem and managed-cloud database instances, though only hosts granting REPLICATION to…

Aug 13, 2026