CVE-2026-6471

Published Aug 13, 2026

Last updated 2 months ago

CVSS high 7.2

Overview

Description
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Source
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
NVD status
Modified
Products
postgresql

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.2
Impact score
5.9
Exploitability score
1.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CWE-862

Social media

Hype score
Not currently trending

  1. PostgreSQL CVE-2026-6471 ("PostGREShell"): 12-year-old privilege escalation via logical decoding abuse. Twelve years in production code before someone found it. The vulnerability you're running isn't always the one you just patched. #PostgreSQL #CVE #Cybersecurity

    @McM1Alex

    15 Sept 2026

    36 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. turns out postgres treated the REPLICATION privilege (the thing every backup script casually has) as basically root for 12 years bro... load any library, run code as the postgres user, nobody caught it since 2014. they're calling it PostGREShell now, CVE-2026-6471

    @shrey_sancheti

    13 Sept 2026

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a persistent database backdoor. https://t.co/jYX6nM3asu

    @ytroncal

    7 Sept 2026

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 【リンク集：週末のセキュリティ関連ニュース/記事】 ＜脆弱性＞ ・Google、Chromeのゼロデイ脆弱性を修正　今年に入って6件目（CVE-2026-85046） https://t.co/tWcD7Udnnx ・PostgreSQLにおける12年来の脆弱性でデータベー

    @MachinaRecord

    7 Sept 2026

    1017 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    1 Reply

    0 Quotes

  5. PostgreSQL patched CVE-2026-6471: a logical decoding auth flaw lets any user with REPLICATION privilege load arbitrary shared libraries as the `postgres` OS user. Patch now. #PostgreSQL #CyberSecurity #InfoSec https://t.co/hTmk8JMuTY

    @CyberWorldOps

    6 Sept 2026

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 12-year-old PostgreSQL flaw just turned “harmless” replication accounts into full server takeovers. PostGREShell (CVE-2026-6471). Low-priv backup account → code execution → superuser → persistent backdoor. This sat open since 2014. Patch now. https://t.co/nwkf6cTU5E

    @PadhiyarRushi

    6 Sept 2026

    291 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. REPLICATION isn't soft. CVE-2026-6471: REPLICATION can dlopen any OS-visible file via logical decoding. Fixed: 18.6/17.11/16.15/15.19/14.24. Whitelist: output_plugin_libraries. Fork: strip unused REPLICATION vs list wal2json first. #PostgreSQL #Security #CVE #Database #DevOps

    @Sunil_kumawat17

    6 Sept 2026

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Legacy software is low risk if air-gapped. A 12-year-old PostgreSQL flaw (CVE-2026-6471) still enables full server takeover via replication access. #CyberAwareness #CyberSecurity

    @Lumideezy

    6 Sept 2026

    134 Impressions

    1 Retweet

    6 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. A PostgreSQL backup account can now run code on your server. Patch CVE-2026-6471. A low-privilege Postgres REPLICATION account can run code and reach superuser via CVE-2026-6471. Patch the August releases and audit your roles. https://t.co/Ln73qO8F20

    @ITGuys_ro

    4 Sept 2026

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover: Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a persistent database backdoor. The post 12-Year-Old… https://t.co/dJaSETAKIO

    @shah_sheikh

    4 Sept 2026

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.•CVE-2026-6470
  2. Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.•CVE-2026-6464
  3. Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.•CVE-2026-6469
  4. Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.•CVE-2026-19385
  5. Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.•CVE-2026-18408

References

Sources include official advisories and independent security research.