PostgreSQL's own security page for CVE-2026-6471 (fix published 13 August 2026) describes missing authorisation in logical decoding: a non-superuser with REPLICATION privilege can cause the server to dlopen any file visible to the OS account running PostgreSQL by choosing the logical decoding plugin path, which runs arbitrary code as that account. Affected before 18.6, 17.11, 16.15, 15.19, and 14.24; fixed in those builds.

Vendor CVSS 3.0 is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Cyera Research, which named the flaw PostGREShell in a 1 September 2026 write-up, says the plugin name in a CREATE_REPLICATION_SLOT command reaches the library loader without the path check, letting an account with the REPLICATION attribute (held by backup tools, standby servers, CDC pipelines and monitoring systems) run code, escalate to superuser and install persistent backdoors. (source: Cyera Research)

Inventory roles with REPLICATION, patch to the fixed minor releases, and do not treat REPLICATION as a low-privilege convenience grant.

Correction (03 Nov 2026): removed SecurityWeek as a source. (source: Cyera Research)