PostgreSQL Replication Privilege Opens Server Control
Cyera reports that a 12-year-old PostgreSQL flaw, CVE-2026-6471, can turn the REPLICATION privilege into code execution and persistent server takeover. PostgreSQL releases since 2014 are affected, and the issue is tracked as PostGREShell.
The bug sits in logical decoding: PostgreSQL trusts the replication plugin name too much, so a non-superuser can point it at an OS-visible file and make the server load it as code. Because that code runs inside the postgres process with no sandbox, an attacker can pivot from a seemingly narrow database privilege to superuser control and a backdoor that survives a simple password reset.
For teams that hand REPLICATION to backup, monitoring, or pipeline accounts, the exposure is not confined to database reads and writes. If one of those standing integration accounts is abused, the trust boundary extends into the server process itself, and cleanup has to account for more than the database login that was stolen.