CVE-2026-6471
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVSS score7.2 / 10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-862
Vendorspostgresql
Affected products
| Vendors | Product | Versions |
|---|---|---|
| postgresql | postgresql | < 14.24 |
Related articles
PostgreSQL Logical Decoding Flaw Allows Code Execution as the `postgres` User
PostgreSQL CVE-2026-6471 lets REPLICATION users load arbitrary libraries via logical decoding to execute code as postgres. See affected versions and fix.
PostGREShell: a PostgreSQL flaw turns replication accounts into a launchpad for code execution
CVE-2026-6471 lets PostgreSQL replication users load arbitrary code via logical decoding, gaining OS and superuser access. Patch now.
This product uses the NVD API but is not endorsed or certified by the NVD.