PostgreSQL logical decoding PostGREShell (CVE-2026-6471): REPLICATION role to arbitrary dlopen/RCE

PostgreSQL's own security page for CVE-2026-6471 (fix published 13 August 2026) describes missing authorisation in logical decoding: a non-superuser with REPLICATION privilege can cause the server to dlopen any file visible to the OS account running PostgreSQL by choosing the logical decoding plugin path, which runs arbitrary code as that account. Affected before 18.6, 17.11, 16.15, 15.19, and 14.24; fixed in those builds. Vendor CVSS 3.0 is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Cyera's PostGREShell research (covered by SecurityWeek on 4 September 2026) explains how replication-protocol plugin loading can be abused for RCE, privilege escalation and persistence when REPLICATION is granted to backup or monitoring accounts. Inventory roles with REPLICATION, patch to the fixed minor releases, and do not treat REPLICATION as a low-privilege convenience grant.

Product

PostgreSQL (core server, logical decoding)

Versions

Before 18.6 / 17.11 / 16.15 / 15.19 / 14.24; fixed in those releases

CVSS

7.2 (CVSS 3.0, PostgreSQL)

Exploited in Australia?

unknown

Patch to

PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 (or later minor); review REPLICATION grants

Primary: PostgreSQL CVE-2026-6471 (fix 13 Aug 2026) · Vendor: PostgreSQL Global Development Group · CVE: CVE-2026-6471 · SecurityWeek (4 Sep 2026; Cyera PostGREShell)

vulnerabilities cloud