12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code on Database Servers
Brief
A newly disclosed PostgreSQL vulnerability , tracked as CVE-2026-6471 and nicknamed PostGREShell, could allow attackers with low-level replication access to execute arbitrary code on database servers.
The flaw in PostgreSQL logical decoding existed for roughly 12 years and has now been fixed in supported releases. PostgreSQL is widely used to store business data, application records, customer details, financial information, and cloud workloads.
The vulnerability is especially concerning because it affects an account type commonly used for backups, replication, disaster recovery, and change data capture operations.
The issue affects non-superuser PostgreSQL accounts that have the REPLICATION attribute. These accounts are typically used to support database replication, allowing standby servers and backup systems to receive database changes from the primary server.