PostgreSQL CVE-2026-6471, named PostGREShell by researchers, lets an account holding the REPLICATION attribute run arbitrary code as the operating-system user that runs the database server, and the flaw has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. It carries a CVSS score of 7.2. Exploitation needs a REPLICATION account and a server running with wal_level = logical, a configuration common wherever backup tools, standby servers, change data capture (CDC) pipelines, or monitoring systems operate. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

The root cause is a missing authorization check on the logical decoding path. The plugin name supplied in a CREATE_REPLICATION_SLOT command is passed directly to the function that loads the library, and PostgreSQL's normal restriction that confines non-superusers to a single administrator-controlled plugin directory is never applied there. The replication parser accepts almost any character inside a double-quoted plugin name, including path separators and ../ traversal, so a full filesystem path reaches the loader exactly as typed. On Windows the server will even resolve a network path over SMB and load the library from an attacker-controlled machine, writing nothing to the target; on Linux and macOS the same remote trick requires NFS automounting.

The fix, shipped August 13, 2026, adds a server parameter called output_plugin_libraries that whitelists which libraries may load as logical decoding output plugins, defaulting to pgoutput and test_decoding. Installations that rely on other plugins such as wal2json or decoderbufs will have logical decoding refused after the update until an administrator adds the library to the list and reloads the configuration. The PostgreSQL Global Development Group credited Vladimir Tokarev and Yu Kunpeng, with Tokarev detailing it for Cyera Research.

Who actually holds the REPLICATION attribute?

More accounts than teams expect. The REPLICATION attribute is routinely granted to backup and restore tooling, physical and logical standby servers, CDC and streaming pipelines, and some monitoring agents. Each of those service accounts becomes a path to operating-system code execution under this flaw, so the practical blast radius is defined by how liberally REPLICATION has been handed out, not by the small number of humans who are database superusers.

Why does a 12-year-old flaw score only 7.2?

Because it requires an existing privileged attribute, so CVSS treats privileges-required as high, which caps the base score even though the outcome is code execution as the database account. That is a scoring nuance, not a comfort: an attacker who phishes or reuses the credentials of a backup or replication service now has a direct route to the host. Treat any account with REPLICATION plus a logical wal_level as security-sensitive, and weight the code-execution outcome over the 7.2 label.

Our read

A missing authorization check that sat in a mainstream database for twelve years is a reminder that age and popularity are not proof of safety. The fix intentionally breaks setups that used non-default output plugins, so this is a patch that needs a change window and a check of which plugins your pipelines actually load, not a silent update. The durable defense is least privilege on the REPLICATION attribute plus monitoring of who creates replication slots, and then verifying that a compromised backup or CDC account cannot reach the host, rather than assuming the database boundary holds.

Reporting by The Hacker News; technical detail per Cyera Research; version and fix data per the PostgreSQL 18.6 release notes. Sources linked above.

Related: What is a software supply chain attack? and What is privilege escalation?.