PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
Brief
PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers.
Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7. 2). Present in releases dating back to 2014, the flaw can be exploited by attackers with low-level replication access to execute code, escalate privileges and gain permanent superuser access.
“Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin.” reads the advisory . “This in turn runs arbitrary code as that account. Versions before PostgreSQL 18. 6, 17. 11, 16. 15, 15. 19, and 14. 24 are affected.”