thehackernews.com
Sep 4, 2026
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
AI-summarised brief · reviewed before publication
PostgreSQL released security updates on August 13 to fix CVE‑2026‑6471, a 12‑year‑old logical decoding flaw that lets REPLICATION‑privileged accounts load arbitrary libraries and execute code as the database server’s OS user. The vulnerability, present in versions before 18.6, 17.11, 16.15, 15.19, and 14.24, requires wal_level=logical and a REPLICATION attribute. The patch introduces an output_plugin_libraries whitelist, defaulting to 'pgoutput, test_decoding', and blocks unapproved plugins until administrators add them and reload the server. PostgreSQL Global Development Group credited Vladimir Tokarev and Yu Kunpeng for reporting the issue.
💡 Why It Matters
- · The fix curtails a critical privilege escalation vector that could grant attackers full control over PostgreSQL instances, safeguarding production databases, backup systems, and CDC pipelines that rely on logical decoding.
