PostgreSQL has rolled out updates to mitigate a critical security flaw that has existed for over a decade. This vulnerability allowed users with the REPLICATION attribute to execute arbitrary code under the operating system user that runs the database server. Identified as CVE-2026-6471, this issue has been present since the inception of logical decoding in PostgreSQL version 9.4, released in 2014. Affected versions include those prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24.
Understanding the Vulnerability
To exploit this flaw, a user account with the REPLICATION attribute and a server configured with wal_level = logical is required. Commonly, backup systems, standby servers, and change data capture pipelines utilize this attribute. The update introduces a new server parameter, output_plugin_libraries, which specifies permissible libraries for logical decoding output plugins, initially defaulting to ‘pgoutput, test_decoding’.
Vulnerable installations using output plugins such as wal2json and decoderbufs will face logical decoding restrictions post-update, unless administrators include these libraries in the configuration and reload the server settings.
Details of the Fix
The update, released on August 13, addresses a significant security loophole. Previously, replication users had the ability to select any loadable library for logical decoding, creating potential for exploitation. The PostgreSQL Global Development Group introduced a whitelist for allowed output plugins to prevent breaking existing setups while enhancing security.
The issue, dubbed PostGREShell by Cyera Research, arises from the direct passing of the plugin name in a CREATE_REPLICATION_SLOT command to the library loading function. This bypassed existing restrictions on plugin paths and allowed dangerous characters in plugin names.
Administrator Actions and Future Outlook
Administrators are advised to execute specific steps to secure their systems. These include querying existing output plugins, updating PostgreSQL to the latest secure versions, modifying the configuration to include necessary plugins, and reloading the server settings.
Fixed packages are readily available for distributions like Amazon RDS, Debian, SUSE, and Ubuntu. The PostgreSQL advisory covers versions 14 through 18, with future fixes for version 14 ceasing after November 12, 2026.
While the patch has improved security significantly, a residual gap remains. The pg_createsubscriber command has been noted to create replication slots without validating the new parameter, leading to potential setup failures. A patch for this is under review.
Cyera advises reducing exposure by removing unnecessary REPLICATION attributes, restricting replication to known addresses, blocking specific network traffic, and disabling unneeded services. Proactive measures are essential until the update is comprehensively applied.
