PostgreSQL Vulnerability (CVE-2026-6471) Allows Database and Server Takeover
A 12-year-old vulnerability in PostgreSQL, dubbed PostGREShell, allows attackers with replication privileges to gain code execution and permanent superuser access, potentially leading to full server compromise.
A critical security flaw, present in PostgreSQL versions released since 2014, has been discovered that enables attackers with low-level privileges to achieve complete control over both databases and the underlying servers. Cybersecurity firm Cyera identified the vulnerability, tracked as CVE-2026-6471 and nicknamed PostGREShell, which carries a CVSS score of 7.2 and can be exploited for remote code execution and significant privilege escalation.
PostgreSQL, a widely adopted open-source relational database system supporting both SQL and JSON queries, is utilized by numerous organizations globally. The vulnerability stems from a missing authorization check within the database's logical decoding feature. Attackers possessing 'Replication' privileges can exploit this by loading arbitrary operating system files through a logical decoding plugin, effectively establishing a persistent backdoor.
PostgreSQL employs a dedicated replication protocol to synchronize data across multiple replicas for backup and recovery purposes. This protocol requires an account with 'Replication' attributes, which are commonly granted to backup tools, servers, pipelines, and monitoring utilities. Changes are recorded as table events, which external tools can then read.
To facilitate this, external tools create a logical replication slot and specify an output plugin that PostgreSQL loads to format the data stream. Crucially, when a plugin is loaded, PostgreSQL executes its initialization function with the same privileges as the server process. While non-superusers are restricted to loading plugins from an administrator-controlled directory, Cyera found that the plugin's name is passed directly to the loader without adequate validation or sanitization.
This oversight allows an attacker to provide a full filesystem path within the plugin name. The replication protocol's parser is permissive, accepting various characters including slashes, backslashes, dots, and directory traversal sequences like '../'. This enables an attacker to trick the system into loading and executing any file via the dlopen() function, a standard C/C++ mechanism for dynamically loading shared libraries.
Once a malicious file is loaded, it executes with the high privileges of the postgres system user. The code runs within the same address space as PostgreSQL, without any sandboxing or internal API call checks, meaning the server implicitly trusts the loaded code. The attacker can then leverage internal functions to elevate their privileges to that of a bootstrap superuser for the current session.
With superuser privileges obtained, the attacker can directly modify the pg_authid catalog table, which defines user roles and permissions. By flipping all privilege flags to true, they gain permanent superuser status. This grants them unrestricted access to all tables across all databases, the ability to execute arbitrary operating system commands, read sensitive private keys, and write files anywhere the postgres process has permissions.
Furthermore, the PostGREShell vulnerability allows for the deployment of sophisticated backdoor mechanisms. Attackers can configure connections to bypass password authentication, ensure the malicious code copies itself to a stable location for persistence, and even re-apply superuser privileges if they are reverted. Cyera notes that this vulnerability affects all PostgreSQL versions from 9.4 up to 18, impacting a vast number of installations where logical replication is a standard feature. Patches are available for versions 18.6, 17.11, 16.15, 15.19, and 14.24, and organizations are strongly advised to update immediately and audit their replication account privileges.