Reported by 3 outlets

Timeline

1. original reporting

   12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over Databases

   cyberpress.org · 39d ago · September 5th, 2026

   A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged backup and replication accounts to execute arbitrary code , escalate to database superuser privileges, and establish persistent access on vulnerable servers. Tracked as CVE-2026-6471, the flaw was discovered by Cyera Research and affects PostgreSQL versions dating back to 9.4, released in 2014. PostgreSQL addressed the issue in its August 22, 2026 security release, ending a vulnerability window that spanned roughly 12 years. The bug exists in PostgreSQL’s logical replication mechanism, which is commonly used for backup operations, standby databases, change data capture pipelines, migrations, monitoring, and analytics. 12-Year-Old PostgreSQL Flaw Organizations often assign the REPLICATION attribute to service accounts so they can access write-ahead log data without granting full database administrator permissions. Initiate streaming replication (Source: cyera) However, Vladimir Tokarev found that replication users could abuse the CREATE_REPLICATION_SLOT workflow to specify a malicious logical output plugin. PostgreSQL loads these plugins as compiled shared libraries, including .so files on Linux, .dll files on Windows, and .dylib files on macOS. When a plugin is loaded, its initialization code executes inside the PostgreSQL server process . This normally dangerous functionality is protected in the SQL LOAD command through a restricted-library-name validation mechanism. According to Vladimir Toka

2. update from gbhackers.com

   12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code and Take Over Database Servers

   gbhackers.com · 38d ago · September 5th, 2026

   Tracked as CVE-2026-6471, the flaw reportedly affected PostgreSQL releases from version 9.4 onward, leaving a dangerous plugin-loading path exposed for roughly 12 years. Cyera Research disclosed the issue on […] The post 12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code and Take Over Database Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cybersecurefox.com

   PostgreSQL Patches CVE-2026-6471 Logical Decoding RCE 🔗 https:// cybersecurefox.com/en/postgres ql-cve-2026-6471-logical-decoding # postgres

   cybersecurefox.com · 34d ago · September 9th, 2026

   PostgreSQL Patches CVE-2026-6471 Logical Decoding RCE 🔗 https:// cybersecurefox.com/en/postgres ql-cve-2026-6471-logical-decoding # postgres

   via Mastodon https://cybersecurefox.com/en/postgresql-cve-2026-6471-logical-decoding