PostGREShell vulnerability allows server takeover

A severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, has been discovered. This flaw, present in releases dating back to 2014, allows low-privileged attackers to execute code, escalate privileges, and gain permanent superuser access to servers, based on information published by Security Affairs.

The vulnerability stems from missing authorization in PostgreSQL's logical decoding feature. Attackers with replication privileges can exploit this by using a logical decoding plugin to load any file visible to the operating system account running the server. This enables them to execute arbitrary code, potentially leading to a full server takeover and the installation of a persistent backdoor. PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

The flaw allows a low-privilege account, often used for backups or data pipelines, to gain remote code execution across Windows, Linux, and macOS, escalating to full PostgreSQL superuser privileges. Organizations are advised to update their PostgreSQL instances immediately and review replication account privileges.

Source: Security Affairs