CVE-2026-6471: A Twelve-Year-Old Flaw Grants Full Server Control
A missing-authorization bug in PostgreSQL logical decoding lets a REPLICATION-only role load an arbitrary library and escalate straight to superuser.
First Seen: 2014
Affected Products: PostgreSQL (core server)
Impact: CVE-2026-6471 (“PostGREShell”, CVSS 7.2) is a missing-authorization flaw (CWE-862) in PostgreSQL’s logical decoding, where a non-superuser REPLICATION role can name an arbitrary library as an output plugin and have the server load and execute it as the postgres OS user, enabling escalation to database superuser and persistent backdoor access. The defect has been latent since version 9.4 (2014) and affects all supported branches before 18.6, 17.11, 16.15, 15.19, and 14.24, patched August 13, 2026. Exploitation requires a REPLICATION credential and wal_level = logical; it is fileless over SMB on Windows but needs file-write access on Linux/macOS. It is not known to be exploited in the wild, though a public proof-of-concept exists. Patch to a fixed release, revoke unnecessary REPLICATION privileges, and restrict replication access to trusted hosts.
CVE
| CVE | Name | Affected Product | Zero-Day | CISA KEV | Patch |
|---|---|---|---|---|---|
CVE-2026-6471 | (PostGREShell) PostgreSQL Output Plugin Missing Authorization Vulnerability | PostgreSQL (core server) | No | No | Yes |
Vulnerability Details
wal_level = logical. The route to code execution is platform-dependent: on Windows the plugin name resolves over SMB from an attacker server with nothing written to disk, whereas on Linux and macOS the attacker generally needs file-write access first.Vulnerability
| CVE ID | Affected Products | Affected CPE | CWE ID |
|---|---|---|---|
CVE-2026-6471 | PostgreSQL core server before 18.6, 17.11, 16.15, 15.19, and 14.24 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | CWE-862 |
Recommendations
Upgrade affected instances to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24, or the equivalent distribution/managed-service package. Patch standby replicas first and schedule the primary restart around replication lag. Where PostgreSQL is a managed service, confirm the provider applied the engine patch.
The fix introduces an allow-list of permitted output plugins that by default admits only the two plugins shipped with PostgreSQL. Inventory plugins in use via the replication-slots view before updating, then add each required third-party plugin to the allow-list and reload the configuration.
Enumerate every role carrying the REPLICATION attribute and assign each an owner and a purpose; revoke the attribute from any role not actively driving a replica, connector, or backup job. Remember that superuser implies replication capability and warrants the same scrutiny.
Scope every replication entry in host-based authentication to the exact source addresses of legitimate consumers, prefer strong password authentication wrapped in TLS, and eliminate broad-CIDR or trust entries. Block outbound SMB and NFS traffic from database servers as a compensating control.
Treat any replication credential stored in connector configurations, container secrets, or CI variables as potentially exposed over the flaw’s twelve-year lifetime, rotate those credentials after patching, and move them into a managed secret store. Hunt for the database backend process spawning shells or interpreters, and for replication-slot plugin names containing path separators.
Potential MITRE ATT&CK TTPs
Patch Link
References
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)