12-Year-Old PostgreSQL Vulnerability Allows Database and Server Takeover

Discovery of PostGREShell Vulnerability

Cybersecurity firm Cyera has reported a severe vulnerability, identified as CVE-2026-6471 and dubbed PostGREShell, present in all PostgreSQL releases since 2014. This flaw carries a CVSS score of 7.2 and enables attackers with low-level privileges to compromise databases and servers.

Technical Details of the Exploit

The vulnerability is rooted in a missing authorization within PostgreSQL's logical decoding mechanism. Attackers possessing 'Replication' privileges can exploit this by manipulating the logical decoding plugin to load any file visible to the operating system account running the server. This allows for remote code execution and privilege escalation.

PostgreSQL uses a replication protocol for syncing database replicas, requiring accounts with the 'Replication' attribute. When external tools read changes via logical replication, they specify an output plugin. Cyera found that the plugin's name is passed directly to the loader without validation, allowing an attacker to provide a full filesystem path to the dlopen() function, which dynamically loads shared libraries.

Impact and Execution

The replication protocol's parser accepts various characters in a double-quoted plugin name, including directory traversal sequences. This enables an attacker to load and execute arbitrary files through dlopen() with the privileges of the postgres system user. Since code loaded via dlopen() runs in the same address space as PostgreSQL without sandboxing, it can call internal functions to gain superuser privileges and directly modify critical catalog tables like pg_authid.

Widespread Implications

PostgreSQL is a widely adopted open-source relational database system, used by tens of thousands of companies, including large enterprises. The existence of this 12-year-old vulnerability means a significant portion of the PostgreSQL user base could be at risk if they have not yet patched their systems or if the vulnerability remains unaddressed in their specific versions.