PostgreSQL has released security updates to fix a high-severity vulnerability that could allow an account with the REPLICATION attribute to execute arbitrary code as the operating-system user running the database server.
Tracked as CVE-2026-6471 with a CVSS score of 7.2, the vulnerability has existed since logical decoding was introduced in PostgreSQL 9.4 in 2014. It affects versions before PostgreSQL 18.6, 17.11, 16.15, 15.19 and 14.24.
Exploitation requires a PostgreSQL account with the REPLICATION attribute and a server configured with wal_level = logical. Such privileges are commonly assigned to backup tools, standby servers, change data capture pipelines and monitoring systems.
The fix, released on August 13, introduces a new output_plugin_libraries server parameter that acts as a whitelist for libraries allowed to be loaded as logical decoding output plugins. By default, the setting allows pgoutput and test_decoding.
Administrators using other plugins, including wal2json and decoderbufs, will need to add those libraries to the new whitelist after updating. Otherwise, PostgreSQL will refuse to use them for logical decoding.
Security researchers Vladimir Tokarev and Yu Kunpeng reported the vulnerability. Tokarev later detailed the issue in a research report from Cyera, which refers to the vulnerability as PostGREShell.
According to the research, the plugin name supplied through a CREATE_REPLICATION_SLOT command could reach PostgreSQL’s library-loading function without the same path restrictions applied to other users. An attacker could potentially supply a path to a malicious library and have it loaded by the database backend process.
The researchers found that the attack could be used to execute code with the privileges of the PostgreSQL operating-system account. Their testing also demonstrated that a compromised replication account could potentially be elevated to a PostgreSQL superuser and maintain access after a server restart.
PostgreSQL said it did not simply apply its existing LOAD restrictions to replication users because doing so could break existing installations that rely on third-party output plugins. Instead, the project introduced the dedicated whitelist to restrict which libraries can be used during logical decoding.
Administrators should identify the output plugins currently in use before upgrading, install the appropriate PostgreSQL security release, and add any required third-party plugins to output_plugin_libraries. The configuration can then be reloaded without restarting the server.
Fixed packages are available for PostgreSQL 14 through 18 through PostgreSQL and several distribution providers, including Amazon RDS, Debian, SUSE and Ubuntu.
The PostgreSQL project has also warned that additional configuration may be required for some extensions following the security update. The wal2json project has updated its documentation to instruct users to add the plugin to output_plugin_libraries.
A separate issue involving the pg_createsubscriber command remained under review as of September 4. The command can create replication slots using pgoutput without checking the new configuration parameter, meaning its dry-run mode can succeed while the actual conversion later fails.
As of September 4, CVE-2026-6471 had not been added to CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept code had been identified in public repositories.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Until the updates can be installed, organizations can reduce exposure by removing the REPLICATION attribute from accounts that do not require it, restricting replication connections in pg_hba.conf to trusted addresses, blocking outbound SMB and NFS traffic from database servers, and disabling unnecessary automount services.
