Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PostgreSQL security update for logical-decoding code execution (CVE-2026-6471)

Security Patch Release
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

PostgreSQL shipped a security update for CVE-2026-6471, closing a logical-decoding code-execution flaw that can let a REPLICATION-privileged account run code as the database server’s OS user. The fix covers PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 and introduces output_plugin_libraries to restrict which logical-decoding plugins can load. Administrators using non-default plugins such as wal2json or decoderbufs must add them to the allowlist and reload configuration after updating.

Related Happenings

Rails maintainers security patch release for CVE-2026-66066

Security Patch Release
H score40 First: 01.08.2026 17:20 Last: 01.08.2026 17:20 Sources 1

About this happening: Rails published an advisory and version guidance for CVE-2026-66066, a critical Active Storage flaw affecting specific release lines and requiring upgrades. The patch...

Open Happening

Adobe security patch release for CVE-2026-48395

Security Patch Release
H score39 First: 01.08.2026 10:12 Last: 01.08.2026 10:12 Sources 1

About this happening: Adobe shipped a security update for Adobe Bridge on 2026-08-01 that closes eight critical-rated flaws with risk of privilege escalation and arbitrary code execut...

Open Happening

Arista VeloCloud Orchestrator security update for CVE-2026-16812

Security Patch Release
H score55 First: 28.07.2026 01:49 Last: 28.07.2026 01:49 Sources 1

About this happening: Arista patched CVE-2026-16812, a maximum-severity 10.0 OS command injection flaw in on-premises VeloCloud Orchestrator (VCO), after confirming it is actively...

Open Happening

Splunk Enterprise security update for CVE-2026-20253

Security Patch Release
H score52 First: 13.06.2026 16:23 Last: 13.06.2026 16:23 Sources 1

About this happening: Splunk released security updates for CVE-2026-20253, fixing a critical Splunk Enterprise flaw that could enable unauthenticated file operations and remote code e...

Open Happening

LiteSpeed cPanel user-end plugin urgent security update (CVE-2026-48172)

Security Patch Release
H score42 First: 27.05.2026 13:06 Last: 27.05.2026 13:06 Sources 1

About this happening: LiteSpeed released urgent security updates for the cPanel user-end plugin after CVE-2026-48172 was found to be actively exploited, reducing exposure for systems ru...

Latest development: 16.06.2026 13:47

CISA added CVE-2026-48172/CVE-2026-54420 in the LiteSpeed cPanel user-end plugin to the Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to secure affected servers within three days under BOD 26-04. The affected plugin versions before 2.4.8 are described as actively exploited, with FTP or web shell access enabling root escalation on shared hosting servers running CloudLinux/CageFS.

Open Happening

Timeline

  1. 04.09.2026 18:20 2 articles · 13h ago

    PostgreSQL ships CVE-2026-6471 fixes with output_plugin_libraries

    Mitigation Patch Update

    PostgreSQL releases fixes for CVE-2026-6471 and adds output_plugin_libraries, a server parameter that allowlists logical-decoding output plugins with a default of 'pgoutput, test_decoding'; deployments using non-default plugins such as wal2json or decoderbufs must add them to the list and reload the server configuration.

    Show sources
    Open in new tab
  2. 04.09.2026 18:20 1 articles · 13h ago

    Administrators inventory logical-decoding plugins and apply PostgreSQL hardening steps

    Mitigation Patch Update

    Administrators are advised to inventory currently used logical-decoding plugins with SELECT DISTINCT plugin FROM pg_replication_slots WHERE plugin IS NOT NULL;, update to the fixed PostgreSQL branches or equivalent distribution packages, add any non-default plugin to output_plugin_libraries, and reload the configuration with pg_ctl reload or SELECT pg_reload_conf(); additional hardening includes stripping REPLICATION from accounts that do not need it, restricting replication entries in pg_hba.conf to known addresses, blocking outbound SMB and NFS from database servers, and disabling autofs where it is not needed.

    Show sources
    Open in new tab
  3. 01.09.2026 03:00 1 articles · 4d ago

    Cyera Research details PostGREShell logical-decoding exploitation paths

    Technical Analysis Update

    Cyera Research details PostGREShell, explaining that a CREATE_REPLICATION_SLOT plugin name is passed directly to the library loader, that the replication parser accepts path separators and ../ traversal inside a double-quoted plugin name, and that code loaded through the replication path runs as the postgres operating-system user; the write-up also notes Windows SMB retrieval and Linux or macOS NFS automounting requirements.

    Show sources
    Open in new tab