CVE-2026-50736
Received Received - Intake

Arbitrary SQL Execution in pglogical via Queue Messages

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: EnterpriseDB Corporation

Description
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-50736
EUVD
EUVD-2026-49936

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the pglogical extension in PostgreSQL, which is used for logical replication. The issue is that out-of-band commands sent from a publisher to a subscriber are executed at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default setups. A malicious publisher can send crafted messages that execute arbitrary SQL on the subscriber as superuser, allowing privilege escalation from a pglogical user to full superuser.

Detection Guidance

Detecting this vulnerability requires checking PostgreSQL configurations and pglogical subscriptions for unauthorized or suspicious activity. Review subscription settings and queue messages for unexpected SQL commands. No specific commands are provided in the context.

Impact Analysis

If you use pglogical for replication and an attacker gains the ability to direct a subscription to a system they control, they could execute arbitrary SQL commands on your PostgreSQL subscriber as superuser. This could lead to data breaches, unauthorized access, or complete system compromise. The impact is most severe in shared deployments where tenant isolation is critical.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations. It allows unauthorized access to sensitive data, potentially violating confidentiality requirements. Organizations using pglogical in shared environments may fail audits due to inadequate tenant isolation and privilege controls.

Mitigation Strategies

Immediately revoke or restrict non-superuser roles' ability to create subscriptions in PostgreSQL. Review and audit all existing pglogical subscriptions for suspicious activity. Consider disabling pglogical queue mechanisms if not essential until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart