PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
Read original article ↗AI Summary
PostgreSQL has patched a 12-year-old vulnerability, CVE-2026-6471, affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw allows an authenticated replication user to execute arbitrary code as the database OS user by exploiting unvalidated plugin paths in logical decoding. Attackers can leverage path traversal in the CREATE_REPLICATION_SLOT command to load malicious libraries from remote SMB or NFS shares, or local disk, achieving privilege escalation and persistence. The fix introduces a whitelist parameter, output_plugin_libraries, to restrict allowed decoding plugins, but gaps remain, such as in pg_createsubscriber behavior.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.