Critical 12-Year-Old PostgreSQL Vulnerability Exploited for Database & Server Takeover

Post Views: 16

PostgreSQL releases since 2014 contain a critical flaw enabling unauthorized control of databases and underlying servers, according to cybersecurity firm Cyera.

Vulnerability Details

The open-source relational database system, which supports both SQL and JSON queries, is widely adopted across enterprises and organizations. The vulnerability, designated CVE-2026-6471 with a CVSS score of 7.2, is named PostGREShell. It allows remote code execution and privilege escalation through a flaw in the database’s logical decoding component.

How the Flaw Works

The vulnerability arises from a lack of authorization checks in the logical decoding feature, which permits attackers with ‘Replication’ privileges to load arbitrary files accessible to the operating system account running the PostgreSQL server. Logical replication in PostgreSQL relies on a dedicated protocol to synchronize data between primary and secondary databases for backup and recovery.

Exploitation Mechanism

Access to this protocol requires a user account with the Replication attribute, typically granted to backup tools, monitoring systems, and other utilities. Cyera identified that the logical decoding plugin’s name is passed directly to the loader without validation, enabling an attacker to supply a full file system path to the dlopen() function. This function dynamically loads shared libraries in C/C++ applications.

Risks and Impact

The replication protocol’s parser accepts unconventional characters within quoted plugin names, including slashes, backslashes, directory traversal sequences, and Windows UNC paths. This flaw allows an attacker to execute arbitrary files with the privileges of the postgres system user. Once exploited, the malicious plugin can leverage the PostgreSQL server’s internal APIs to escalate privileges.

Affected Versions and Patches

The attacker gains permanent superuser access by modifying the pg_authid catalog table, which governs user permissions. This enables unrestricted access to all database tables, execution of operating system commands, retrieval of private keys, and arbitrary file writes. The vulnerability also facilitates the deployment of persistent backdoors, such as enabling passwordless connections and self-replicating mechanisms.

The flaw affects all PostgreSQL versions from 9.4 to 18, including the latest 18.2 release. Logical replication is a standard feature in production environments, making the vulnerability widespread. PostgreSQL has addressed the issue in versions 18.6, 17.11, 16.15, 15.19, and 14.24.

Recommendations

Users are urged to apply patches immediately, review Replication accounts, and revoke the attribute from unnecessary user accounts. The vulnerability highlights the risks of insufficient input validation in critical database components. Attackers could exploit this flaw to compromise sensitive data, disrupt operations, or establish long-term access to systems.

According to Cyera, “Organizations must prioritize updating PostgreSQL instances and conducting security audits to mitigate exposure.”

Conclusion

Organizations must prioritize updating PostgreSQL instances and conducting security audits to mitigate exposure. The flaw underscores the importance of proactive security measures in critical infrastructure.