PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

Summary: PostgreSQL released updates for CVE-2026-6471 (CVSS 7.2), a flaw present since logical decoding arrived in PostgreSQL 9.4 in 2014 that lets an account with the REPLICATION attribute run arbitrary code as the postgres operating-system user. The August 13 fix adds an output_plugin_libraries parameter defaulting to 'pgoutput, test_decoding', so installations using other plugins such as wal2json and decoderbufs have logical decoding refused until an administrator adds the library and reloads the configuration.
What's compelling: Backup tools, standby servers, CDC pipelines and monitoring systems routinely hold the REPLICATION attribute, and Cyera's test plugin used that access to write the role catalog and make the replication account a superuser, plus three persistence mechanisms that survive a restart. As of September 4 the flaw was absent from CISA's KEV catalog and no public proof-of-concept existed, but PostgreSQL 14 stops receiving fixes on November 12, 2026.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-6471
Related: ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026