A Decade-Old Flaw in PostgreSQL Exposes Databases to Remote Takeover
PostgreSQL, a popular open-source database system used by tens of thousands of companies worldwide, has been found to contain a severe vulnerability that allows attackers with low privileges to take control of databases and servers. The flaw, tracked as CVE-2026-6471, has its roots in a 12-year-old code weakness, which was recently exploited for remote code execution and privilege escalation.
The vulnerability is linked to PostgreSQL’s logical replication feature, which allows multiple replicas of a primary database to be synchronized for backup and recovery purposes. An account with the Replication attribute is required for this process, and it’s typically provided to connected backup tools, servers, pipelines, and monitoring utilities. However, Cyera, the cybersecurity firm that discovered the flaw, found that an attacker can exploit this permission by loading any file visible to the OS account running the server via the logical decoding plugin.
This is made possible because the replication protocol’s parser accepts almost any character inside a double-quoted plugin name, including slashes, backslashes, dots, and even Windows UNC paths. As a result, an attacker can pass a full filesystem path to the loader, allowing them to load and execute any file with the privileges of the postgres system user.
Once the attacker gains this level of access, they can become the bootstrap superuser for the session, write directly to pg_authid – the catalog table that defines who is a superuser – and flip every privilege flag to true. This effectively grants them permanent superuser privileges, enabling them to access every table in every database, execute OS commands, read private keys, and write files to any location accessible by the postgres process.
The implications of this vulnerability are far-reaching, given that PostgreSQL is used by numerous large enterprises and organizations worldwide. Every version from 9.4 through 18 is affected, which means that a significant portion of PostgreSQL installations on the internet are vulnerable. The good news is that CVE-2026-6471 has been patched in versions 18.6, 17.11, 16.15, 15.19, and 14.24.
Organizations using PostgreSQL should take immediate action to address this vulnerability by updating their instances as soon as possible, auditing their Replication accounts, and removing the Replication attribute from any account that doesn’t need it. This may involve a thorough review of their database configurations and privileges, but it’s essential for preventing potential security breaches.
In conclusion, the PostgreSQL community has been made aware of this critical vulnerability, and prompt action is necessary to prevent attackers from exploiting it. As always, staying up-to-date with the latest patches and maintaining robust security practices are crucial in protecting against such threats.
Source: SecurityWeek — 2026-09-04