CVE-2026-6471

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.4 through 18.5

Description Missing authorization in the logical decoding subsystem allows a non-superuser with the REPLICATION privilege to execute arbitrary code as the operating system account running the server. The issue occurs because the plugin name provided in the CREATE REPLICATION SLOT function is passed directly to the library loader, enabling path traversal, absolute paths, or UNC paths to load any file visible to the server account. This flaw has existed since 2014 and can be used for privilege escalation and full server compromise. Real-world evidence indicates that over 100 malicious plugins, including miners and shells, have been identified using this vector.

Recommendations Update PostgreSQL to version 18.6, 17.11, 16.15, 15.19, or 14.24 depending on the major version in use. Audit all database roles to identify and restrict accounts with the REPLICATION attribute to only essential processes. Review pg hba.conf rules to ensure replication access is limited to trusted source hosts. Restrict the database server from making unnecessary outbound SMB or NFS connections to prevent the loading of remote malicious libraries.