PostgreSQL Vulnerability CVE-2026-6471: Critical Security Update
- Severity
- CRITICAL
- Affected component
- postgresql (other)
- Patched version
- Not yet available
PostgreSQL has released updates to address a critical 12-year-old vulnerability, tracked as CVE-2026-6471, that allows attackers with low-level replication access to execute arbitrary code and gain superuser privileges.
What happened
The vulnerability, dubbed PostGREShell, has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. Exploitation requires an account with the REPLICATION attribute and a server running with wal_level = logical.
The flaw allows an attacker to run arbitrary code as the operating-system user running the database server. The fix, shipped on August 13, adds a server parameter called output_plugin_libraries that lists which libraries may be loaded as logical decoding output plugins, defaulting to 'pgoutput, test_decoding'.
Installations using any other output plugin, such as wal2json and decoderbufs, will have logical decoding refused after updating until an administrator adds the library to the list and reloads the server configuration.
What to do about it
- Upgrade to the latest version of PostgreSQL that patches CVE-2026-6471.
- Review and update your database access controls to ensure only authorized users have replication access.
- Add any necessary output plugins to the output_plugin_libraries parameter and reload the server configuration.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
postgresql is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24, you are affected.
What should I do right now?
Upgrade to the latest version of PostgreSQL and review your database access controls.
What is the CVSS score of this vulnerability?
The CVSS score of CVE-2026-6471 is 7.2.