PostgreSQL Fixes 12-Year-Old Critical Server Takeover Flaw
Replication accounts could execute arbitrary code since 2014
1Vulnerability Overview
PostgreSQL patched a critical 12-year-old flaw (CVE-2026-6471, CVSS 7.2) allowing replication users to execute arbitrary code as the database server's OS user. Present since logical decoding's introduction in 2014 (PostgreSQL 9.4+), it affects versions before 18.6, 17.11, 16.15, 15.19, and 14.24. The vulnerability enables attackers with REPLICATION privileges to load malicious libraries through logical decoding plugins, granting full server control.
2Exploit Mechanism
Attackers abuse PostgreSQL's logical decoding feature by supplying a malicious plugin path in CREATE_REPLICATION_SLOT commands. The system loads plugins without proper path validation, accepting traversal sequences (../) and network paths. On Windows, attackers can load libraries via SMB shares; on Linux/macOS via NFS if enabled. The loaded code executes with database server privileges, bypassing PostgreSQL's usual plugin path restrictions.
3Attack Impact
Successful exploitation grants attackers persistent superuser access, allowing database/server takeover. Attackers can install backdoors, exfiltrate data, or compromise connected systems. The vulnerability is particularly dangerous because replication accounts—common in backup tools, standby servers, and monitoring systems—typically have the required REPLICATION privilege, making many enterprise deployments vulnerable.
4Affected Components
The flaw impacts servers with wal_level=logical configuration, which is standard for change data capture (CDC), logical replication, and some backup solutions. Popular output plugins like wal2json and decoderbufs are affected. After patching, administrators must manually whitelist non-default plugins (pgoutput, test_decoding) via the new output_plugin_libraries parameter.
5Patch Details
PostgreSQL's August 13 update introduces output_plugin_libraries—a whitelist controlling loadable plugins. Default values include only pgoutput and test_decoding. Systems using other plugins will break until administrators update the whitelist and reload configurations. The fix maintains backward compatibility while preventing unauthorized library loading.
6Discovery Timeline
Researchers Vladimir Tokarev and Yu Kunpeng discovered the flaw, reported through Cyera Research, who named it PostGREShell. Cyera published technical details on September 1, revealing how the replication protocol's parser accepts dangerous plugin paths. PostgreSQL credited the researchers in release notes for versions 18.6+.
7Enterprise Risk
PostgreSQL's widespread enterprise adoption—from financial systems to government databases—amplifies the flaw's impact. Many organizations use logical replication for high availability and analytics, often granting REPLICATION privileges broadly. The 12-year vulnerability window means countless legacy systems may remain unpatched, especially in regulated industries with change control restrictions.
8Action Required
Administrators must immediately update to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24. Post-update, verify output_plugin_libraries contains all required plugins. Audit replication accounts and monitor for suspicious CREATE_REPLICATION_SLOT commands. Consider network-level restrictions for database servers, especially blocking outbound SMB/NFS traffic where possible.
Original article: The Hacker News — PostgreSQL Fixes 12-Year-Old Critical Server Takeover Flaw