CVE-2026-50737

Name of the Vulnerable Software and Affected Versions pglogical (affected versions not specified)

Description When applying replicated changes for a row missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Since the apply worker operates with privileges equivalent to a PostgreSQL superuser in default installations, any function triggered by a default expression also executes with those privileges. A malicious publisher can exploit this to execute functions on the subscriber as a superuser, escalating privileges from a role permitted to use pglogical to full superuser. This issue is particularly relevant in managed deployments where the ability to create subscriptions has been delegated to non-superuser roles, as exploitation requires directing a subscription to an endpoint controlled by the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.