CVE 2026 6471

www.postgresql.org • September 9, 2026

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

For more information PostgreSQL versioning , please visit the versioning page .

Reporting Security Vulnerabilities

If you wish to report a new security vulnerability in PostgreSQL, please send an email to [email protected] .

For reporting non-security bugs, please see the Report a Bug page.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PostgreSQL Vulnerability Exposes Databases to Remote Code Execution A critical vulnerability, tracked as CVE-2026-6471 and dubbed PostGREShell, has been discovered in PostgreSQL, affecting versions since 2014. This flaw allows attackers with low-privilege replication accounts to execute arbitrary code on the database server, leading to full database and server compromise. The vulnerability was identified by Cyera Research and has a CVSS score of 7.2. Exploitation requires an account with the REPLICATION attribute and a server configured with wal_level set to logical. The flaw has been present in over 39,000 companies using PostgreSQL, including major platforms like Netflix and Uber. A patch was released on August 13, 2026, to address this issue. Attackers can leverage this vulnerability to install persistent backdoors and escalate privileges to superuser status. The vulnerability's wide impact stems from PostgreSQL's role in handling sensitive data across various sectors. 9 sources 72

Extracted Entities

CVE 2026 6471

The full story

Extracted Entities

CWE Weaknesses (1)

Domains (1)

Email Addresses (1)

Platforms (1)