🟠 High: PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

[XploitLK-Bot]

PostgreSQL has shipped security updates to close a 12-year-old vulnerability that could let someone with the REPLICATION attribute execute arbitrary code as the operating-system user running the database server. The bug, tracked as CVE-2026-6471 with a CVSS score of 7.2, has been lingering since logical decoding was first introduced in PostgreSQL 9.4 back in 2014.

The root cause lies in how logical decoding handles certain internal operations, allowing a privileged-but-not-superuser account to escalate its control over the host system. In practical terms, an authenticated user with the replication role could drop into the underlying OS user context of the database process—effectively bypassing the intended security boundary between the database role and the host environment.

The following versions are patched and should be deployed immediately:

• PostgreSQL 18.6
• PostgreSQL 17.11
• PostgreSQL 16.15
• PostgreSQL 15.19
• PostgreSQL 14.24

Any installations running earlier releases are exposed. If you're managing a PostgreSQL fleet, your first step should be to confirm which versions are in use, then plan an upgrade window before applying the fix. Since this flaw has been dormant for over a decade, it's also worth auditing replication-role assignments to ensure that only trusted accounts hold that privilege in the first place.

Source: The Hacker News

Is your team currently running any PostgreSQL instances on the older branches listed here, and how are you sequencing the patching across production and dev environments?