← News
/DISPATCH · 2026-09-05

12-year PostgreSQL bug PostGREShell enables full database takeover; patched releases out

Cyera disclosed PostgreSQL logical-decoding bug CVE-2026-6471 (PostGREShell), present since 9.4 (2014). An account with REPLICATION can load an arbitrary library, get OS-level code execution, and permanently escalate to superuser. Fixed releases are out.

Database security firm Cyera published a technical analysis on September 1 of a 12-year-old PostgreSQL logical-decoding vulnerability, CVE-2026-6471, dubbed PostGREShell. A non-superuser with the REPLICATION attribute can cause the server process to load an arbitrary shared library, execute code as the database server's OS account, then permanently escalate to PostgreSQL superuser and plant a persistent backdoor. Official patches shipped August 13 with each branch's security releases.

Incident overview

The root cause dates to logical decoding, introduced in PostgreSQL 9.4 in 2014. Affected versions: 9.4 through 18. Fixed: 18.6, 17.11, 16.15, 15.19, 14.24. REPLICATION is routinely granted to backup tools, standbys, CDC pipelines, and monitoring, and is often treated as a low-risk backup credential. Official CVSS is 7.2, privileges required rated High.

Technical details

A logical-replication client must specify an output plugin when creating a replication slot. PostgreSQL originally restricted non-superusers to plugins from an admin-controlled directory, but the plugin name on the replication-protocol path was not validated: the parser accepts slashes, backslashes, and `../` path traversal inside a double-quoted plugin name, and the full filesystem path is passed as-is to the dynamic loader `dlopen()`. On Windows an attacker can use a UNC path so the server pulls a malicious DLL from an attacker-controlled SMB share. Linux and macOS need NFS automount; other cases require dropping a file on the server disk first. Loaded code runs in the same address space as PostgreSQL and can rewrite `pg_authid` to promote the replication account to superuser. Cyera's demo plugin also implemented multiple persistence mechanisms.

Impact assessment

Logical replication is production default; the path exists in nearly every PostgreSQL deployment. Successful exploit yields all database data, OS command execution, private-key theft, and lateral movement from the database host. Managed-database patch lag typically trails upstream; cloud users must verify vendor status. No confirmed in-the-wild exploitation yet, but technical details are fully public. Weaponization is a matter of time.

Remediation

SELECT DISTINCT plugin FROM pg_replication_slots WHERE plugin IS NOT NULL;
SELECT rolname FROM pg_roles WHERE rolreplication = true;

Remove unneeded privileges and rotate related credentials.

References