12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over Databases
Brief
A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged backup and replication accounts to execute arbitrary code , escalate to database superuser privileges, and establish persistent access on vulnerable servers.
Tracked as CVE-2026-6471, the flaw was discovered by Cyera Research and affects PostgreSQL versions dating back to 9. 4, released in 2014. PostgreSQL addressed the issue in its August 22, 2026 security release, ending a vulnerability window that spanned roughly 12 years.
The bug exists in PostgreSQL’s logical replication mechanism, which is commonly used for backup operations, standby databases, change data capture pipelines, migrations, monitoring, and analytics.