PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server.
Intelligence analysis by Qwen 2.5 (3B)
PostgreSQL has patched a 12-year-old security flaw that could allow attackers to execute arbitrary code as the database server user. The fix involves adding a whitelist of allowed output plugins.
PostgreSQL, a database system, has fixed a bug that could let bad guys run their own code as the person who runs the database. They added a list of allowed code to prevent this.
Analysis
{"heading":"The Vulnerability","subheading":"Logical Decoding Flaw","content":["PostgreSQL, a popular open-source database management system, has released updates to address a security flaw that has been present since its introduction in 2014. The flaw, tracked as CVE-2026-6471, has a CVSS score of 7.2.","The vulnerability allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. This flaw has been present since logical decoding was introduced in PostgreSQL 9.4.","The fix involves adding a server parameter called output_plugin_libraries that lists which libraries may be loaded as logical decoding output plugins. The default list includes 'pgoutput' and 'test_decoding'."]}
Key points
- PostgreSQL has fixed a 12-year-old security flaw
- The fix involves adding a whitelist of allowed output plugins
- The vulnerability could allow attackers to run arbitrary code as the database server user
- The fix is available for PostgreSQL versions 14 through 18
- A gap in the fix for the pg_createsubscriber command is still open
The fix will help protect PostgreSQL databases from attacks that could allow unauthorized code execution.
There is still a gap in the fix for the pg_createsubscriber command, which could allow attackers to bypass the new parameter and execute code as the database user.
