POSTGRESQL has been revealed to contain a critical vulnerability, CVE-2026-6471, nicknamed PostGREShell, that dates back to 2014 and affects PostgreSQL releases from 9.4 upwards. Cyera’s researchers describe a flaw in PostgreSQL’s logical decoding feature that lets a non-superuser with Replication privileges load a plugin via the replication pathway.
By passing a full filesystem path to the loader, an attacker can cause the server to dlopen or LoadLibrary a file visible to the OS account running PostgreSQL, enabling arbitrary code execution with the server’s privileges. This can lead to a persistent backdoor, ownership of the database, and full control over the underlying server across Windows, Linux and macOS.
The advisory notes that, with this foothold, attackers could create a permanent superuser, access all tables across databases, execute OS commands, read private keys, and write files wherever the PostgreSQL process has access. The flaw’s reach is broad because logical replication is widely used for backups, data pipelines and monitoring, often granting Replication accounts to assorted tools and services. PostgreSQL patched CVE-2026-6471 in versions 18.6, 17.11, 16.15, 15.19 and 14.24.
Organisations are urged to update promptly and to audit Replication accounts, removing the Replication attribute where it is not required. The report stresses that the vulnerability permits code execution via the loader when a replication plugin is specified, highlighting the need for cautious plugin handling and strict access controls.