SECURITYWEEK reports a long‑standing PostgreSQL flaw, dubbed PostGREShell, tracked as CVE-2026-6471, which can allow an attacker with low privileges to seize control of databases and the server. The issue resides in the database’s logical decoding and is exploitable by anyone with Replication privileges to load a file visible to the OS account running PostgreSQL via a logical decoding plugin.
PostgreSQL uses a replication protocol to synchronise replicas for backup and recovery, and an account with the Replication attribute is often provided to backup tools and monitoring utilities.
Cyera’s analysis explains that when a plugin is loaded, PostgreSQL runs its init function with the server process’s privileges. Because the plugin name is passed to the loader without proper validation, an attacker can supply a full filesystem path (including traversal and UNC-style paths) that dlopen() loads. The loaded code executes with PostgreSQL’s privileges and can trigger a bootstrap superuser, altering pg_authid to grant permanent superuser rights and turning on all privileges.
The consequence is a persistent backdoor enabling OS‑level access, unrestricted data exfiltration, and the ability to bypass password protections. The report states the flaw affects versions from 9.4 through 18 (confirmed on 18.2), with replication remaining a common production practice.
PostgreSQL has patched CVE-2026-6471 in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organisations are advised to update promptly, audit Replication accounts, and remove the Replication attribute from accounts that do not require it.