A severe vulnerability, tracked as CVE-2026-6471 (CVSS score 7.2), has been discovered in PostgreSQL, affecting all versions since 2014. The vulnerability, known as PostGREShell, allows attackers with low privileges to take control of databases and servers through a missing authorization in logical decoding. Attackers with 'Replication' privileges can exploit this flaw to execute arbitrary code and gain superuser access without proper authentication.
The issue arises from the lack of validation in the plugin naming process, enabling the execution of any file on the server. Affected organizations are advised to update to the patched versions and remove unnecessary replication privileges.