PostgreSQL patches 12-year logical decoding RCE flaw

The PostgreSQL project published a security advisory for CVE-2026-6471: logical decoding can dlopen an arbitrary file. A non-superuser who already holds REPLICATION privilege can pick a logical decoding plugin and run code as the operating-system account that runs the server. The project scores it CVSS 3.0 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) on the core server.

The advisory is official PostgreSQL guidance, not a CISA Known Exploited Vulnerabilities addition and not an unauthenticated internet-worm notice. An attacker needs an account that already holds REPLICATION, the privilege used for backups, standbys, and change-data-capture.

Affected lines are versions before 18.6, 17.11, 16.15, 15.19, and 14.24. The fixes shipped in those releases on 13 August 2026. Some secondary writeups still name 18.5 as the 18-series fix. The project's advisory text uses 18.6.

Cyera calls the bug PostGREShell and says the path has been present since logical decoding landed in 9.4 in 2014. Exploitation also needs wal_level set to logical, a common setting for change-data-capture and standbys.

The patch adds an output_plugin_libraries allowlist. It defaults to pgoutput and test_decoding. The Hacker News says administrators should run SELECT DISTINCT plugin FROM pg_replication_slots before they upgrade, then add any non-default plugin and reload with pg_reload_conf. A restart is not required.

The shape is a privileged-path RCE, unlike the unauthenticated JFrog Artifactory auth bypass.

Some offers on this page may be paid placements or contain affiliate links.