A PostgreSQL vulnerability that has existed undetected for roughly 12 years can let a low-privileged database account escalate to complete, persistent control of the server, researchers have disclosed.
A Decade-Old Gap in a ‘Low-Risk’ Privilege
Tracked as CVE-2026-6471 and nicknamed PostGREShell by the Cyera Research team that found it, the flaw carries a CVSS score of 7.2 and stems from a missing authorization check in PostgreSQL’s logical decoding feature, present since the capability was introduced in version 9.4 in 2014. An account holding only the REPLICATION privilege — typically granted for backup or data-pipeline purposes and long treated as a low-risk, read-only permission — can use a logical decoding output plugin to make the server load an arbitrary shared library file. That library executes as native code inside the PostgreSQL server process, running with the privileges of the operating-system account that runs the database.
Successful exploitation can lead to arbitrary code execution, privilege escalation to permanent superuser status, and installation of a persistent backdoor, effectively handing an attacker full control of the server and any data it holds.
Patched in August, Disclosed in September
The PostgreSQL project shipped a fix for CVE-2026-6471 on August 13, 2026, bundled with 27 other security patches in versions 18.6, 17.11, 16.15, 15.19 and 14.24. Branches earlier than version 14 do not receive a fix. Cyera reported the issue to the PostgreSQL security team on February 21, 2026, with the team confirming it six days later; discovery credit was given to researchers Vladimir Tokarev and Yu Kunpeng. Security researchers are advising organizations to update affected instances immediately, audit which accounts hold the REPLICATION attribute, and remove it from any account that does not strictly require it.
Leave a Reply