A recently discovered vulnerability in PostgreSQL, dating back to 2014, poses a significant threat by allowing attackers with minimal privileges to commandeer databases and servers. PostgreSQL, an open-source database management system, supports both SQL and JSON queries and is widely utilized by numerous organizations globally. Identified as CVE-2026-6471 or PostGREShell, this flaw carries a CVSS score of 7.2 and enables remote code execution and privilege escalation. The issue stems from inadequate authorization in the database's logical decoding process. Attackers with 'Replication' privileges can exploit this to load files visible to the operating system account running the server, using the logical decoding plugin.
PostgreSQL employs a dedicated replication protocol for syncing multiple replicas of a primary database, essential for backup and recovery. Accounts with the Replication attribute are automatically assigned to various connected tools like backup utilities and monitoring systems. Changes are recorded as table events through local replication, allowing external tools to read these events by creating a logical replication slot and naming an output plugin, which PostgreSQL then loads to format the stream.
Cyera, the cybersecurity firm that identified the issue, discovered that the plugin's name is passed without validation, enabling an attacker to provide a full filesystem path to the loader. This path is served to the dlopen() function, which is used for dynamically loading shared libraries. Consequently, attackers can execute any file with the privileges of the postgres system user. The loaded code runs within the same address space as PostgreSQL without sandboxing, allowing it to call internal functions and gain superuser privileges.
Once superuser access is achieved, attackers can manipulate database tables, execute operating system commands, and access sensitive information. Moreover, the plugin can establish a persistent backdoor, allowing connections without passwords and ensuring it reloads with every new backend session. This vulnerability affects PostgreSQL versions from 9.4 to 18, with logical replication being a standard feature. PostgreSQL has addressed the issue in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations should promptly update their systems, audit Replication accounts, and remove the Replication attribute where unnecessary.
