CVE-2026-50736

Name of the Vulnerable Software and Affected Versions pglogical (affected versions not specified)

Description The pglogical queue mechanism, which transmits out-of-band commands like replicated DDL (Data Definition Language) from a publisher to a subscriber, executes message payloads on the subscriber using the privilege level of the apply worker. In default installations, this level is equivalent to a PostgreSQL superuser. An attacker acting as the publisher can send crafted queue messages to execute arbitrary SQL on the subscriber as a superuser. This allows for privilege escalation from a role permitted to use pglogical to full superuser status, potentially breaking tenant isolation in shared deployments. Exploitation requires the attacker to direct a subscription to an endpoint they control, a capability typically reserved for superusers but often delegated to non-superuser roles in managed deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.