CVE-2026-6471
Received Received - Intake

Missing Authorization in PostgreSQL Logical Decoding Plugin

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-6471
EUVD
EUVD-2026-57857

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files by selecting a malicious logical decoding plugin. This can lead to arbitrary code execution with the privileges of the operating system account running the PostgreSQL server.

Detection Guidance

Check PostgreSQL version with 'psql --version' or 'SELECT version();'. If running versions before 18.5, 17.11, 16.15, 15.19, or 14.24, the system is vulnerable. Review users with REPLICATION privilege using 'SELECT usename FROM pg_user WHERE usesysid IN (SELECT oid FROM pg_authid WHERE rolreplication = true);'.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server, potentially gaining control over the database and accessing sensitive data. This could lead to data breaches, unauthorized modifications, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Upgrade PostgreSQL to a patched version (18.5, 17.11, 16.15, 15.19, or 14.24). Remove REPLICATION privilege from non-superusers if not required. Restrict file system access for the PostgreSQL user account.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart