Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PostgreSQL logical decoding replication RCE (CVE-2026-6471)

Vulnerability
First reported
Last updated
Happening score
H score 26
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-6471 in PostgreSQL logical decoding lets a user with the REPLICATION attribute run code as the database server OS user, and fixed builds are now available. The flaw affects versions before 18.6, 17.11, 16.15, 15.19, and 14.24 and requires wal_level = logical. PostgreSQL added output_plugin_libraries to whitelist allowed logical-decoding plugins and block arbitrary library loading. Administrators running replication features should update and review which plugins their slots depend on.

Timeline

  1. 04.09.2026 18:20 1 articles · 13h ago

    PostgreSQL adds output_plugin_libraries to whitelist logical decoding plugins

    Mitigation Patch Update

    PostgreSQL ships the output_plugin_libraries parameter, limiting logical decoding to allowed output plugins such as pgoutput and test_decoding and refusing non-default plugins until an administrator adds them to the allowlist and reloads the server configuration.

    Show sources
    Open in new tab
  2. 04.09.2026 18:20 1 articles · 13h ago

    Cyera Research details the PostGREShell logical decoding exploit path

    Technical Analysis Update

    Cyera Research publishes the PostGREShell analysis, describing how CREATE_REPLICATION_SLOT passes a plugin name directly to the library loader, how the replication parser can accept path separators and ../ traversal, and how attacker-controlled SMB or NFS paths can deliver code to the database backend process.

    Show sources
    Open in new tab
  3. 04.09.2026 18:20 2 articles · 13h ago

    PostgreSQL releases CVE-2026-6471 fixes and admin guidance

    Initial Disclosure

    PostgreSQL discloses CVE-2026-6471, a logical decoding flaw affecting versions before 18.6, 17.11, 16.15, 15.19, and 14.24, and advises administrators to identify in-use replication slots, upgrade to the fixed releases, and add any non-default plugin to output_plugin_libraries before reloading configuration.

    Show sources
    Open in new tab