CVE-2026-6471
CVSS 7.2 HIGH: missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen… EPSS 0.5% (42nd percentile).
Vulnerabilities & Exploits
Cyera reports that a 12-year-old PostgreSQL flaw, CVE-2026-6471, can turn the REPLICATION privilege into code execution and persistent server takeover. PostgreSQL releases since 2014 are affected, and the issue is tracked as PostGREShell.
The bug sits in logical decoding: PostgreSQL trusts the replication plugin name too much, so a non-superuser can point it at an OS-visible file and make the server load it as code. Because that code runs inside the postgres process with no sandbox, an attacker can pivot from a seemingly narrow database privilege to superuser control and a backdoor that survives a simple password reset.
For teams that hand REPLICATION to backup, monitoring, or pipeline accounts, the exposure is not confined to database reads and writes. If one of those standing integration accounts is abused, the trust boundary extends into the server process itself, and cleanup has to account for more than the database login that was stolen.
2 sources · Sep 4
CVSS 7.2 HIGH: missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen… EPSS 0.5% (42nd percentile).
The Hacker News
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixes CVE-2026-6471, which lets replication accounts load libraries and run code when logical WAL is enabled.
originalSecurityWeek
12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover
Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a persistent database backdoor.
originalPart of the PlainSec briefing for 2026-09-07
Every edition of this story: PostgreSQL replication privilege opens server control