Open-Source Database Fixes 12-Year-Old Replication Code Flaw

The open-source database has released fresh updates to close a vulnerability in its logical decoding feature that could allow a database account with replication rights to run arbitrary code as the operating system user that runs the database server. The flaw, tracked as CVE-2026-6471 with a CVSS score of 7.2, has existed since logical decoding was introduced in version 9.4 of this database in 2014, making it roughly twelve years old. All versions before the latest releases 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. Exploitation requires two conditions: an account carrying the REPLICATION attribute and a server running with wal_level = logical. Backup tools, standby servers, change data capture (CDC) pipelines, and monitoring systems routinely hold that attribute, so the practical exposure can reach into many production environments.

Logical decoding is a feature of the open-source database that turns the internal record of database changes into a readable stream, which tools such as backup software and data replication systems can consume. The update shipped on August 13 adds a new server parameter called output_plugin_libraries. This parameter is a whitelist of libraries that may be loaded as logical decoding output plugins, and it defaults to the built-in output plugin and the built-in test decoding plugin. Installations using any other output plugin, including wal2json and decoderbufs, will have logical decoding refused after updating until an administrator adds the library to that list and reloads the server configuration. The project behind the open-source database explained in the 18.6 release notes that a replication user could previously select any loadable library for logical decoding, which allowed various exploits, and the new whitelist locks this down without breaking previously working setups.

The project behind the open-source database credited Vladimir Tokarev and Yu Kunpeng with reporting the problem. Tokarev published a detailed write-up on September 1 for data security firm Cyera Research, which names the flaw PostGREShell. Cyera explained that the plugin name supplied when creating a replication slot is passed directly to the function that loads the library. The database's existing restriction on plugin paths, which confines non-superusers to a single administrator-controlled directory, is never called on the replication path. Moreover, the replication protocol's parser accepts almost any character inside a double-quoted plugin name, including path separators and ../ traversal, so a full filesystem path reaches the loader as typed. On Windows, the server resolves a network path over Server Message Block (SMB) and fetches the library from a machine the attacker controls, writing nothing to the target, Cyera said. On Linux and macOS, the same result requires enabling Network File System (NFS) automounting. Everywhere else the attacker needs an existing way to write a file to the server's disk. Code loaded this way runs inside the database backend process as the operating system user that runs the database server.

Cyera's test plugin then wrote the role catalog directly to make the replication account a superuser of the open-source database, an administrator-level account. It also set up three persistence mechanisms that survive a server restart. Cyera describes the REPLICATION attribute as a low-privilege backup credential, but the open-source database scored the flaw with Privileges Required set to High, a rating reproduced in SUSE's own assessment. The project rejected applying its existing LOAD restriction to the replication path. Jacob Champion, who wrote the fix, explained in the commit message that REPLICATION users were not previously subject to restrictions on output plugin paths, so they could bypass LOAD-time protections during logical decoding. Adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the plugin directory, which would break existing setups. Failed loads are recorded in the server log with a message that the library may not be used as an output plugin, with a hint naming the setting, according to the parameter's documentation.

Administrators are advised to query the replication slot catalog to list the output plugins currently in use, which will only show plugins successfully used at some point. They should then update to 18.6, 17.11, 16.15, 15.19, or 14.24, or to the equivalent distribution package. Any non-default plugin must be added to output_plugin_libraries and the configuration reloaded using the standard control command or the configuration reload function. A restart is not required. When migrating from version 17 or later, the new cluster's output_plugin_libraries should be set before running the upgrade utility's check mode, as the check fails if the list does not permit the old cluster's slot plugins. Fixed packages are available on Amazon RDS for all five branches, as well as from Debian, SUSE, and Ubuntu. The project's advisory covers supported branches 14 through 18 and does not address earlier ones. Version 14 stops receiving fixes on November 12, 2026, the project said in its release announcement.

The upstream fix "requires additional changes to the configuration if some extensions are used," Debian's advisory warns, naming its wal2json and decoderbufs packages. Ubuntu's USN-8653-1, which shipped the fix for 22.04, 24.04, and 26.04 LTS on August 20, makes no mention of the parameter and tells administrators only to restart the database server after the update. As of September 4, the wal2json project had updated its documentation to tell users to add the plugin to output_plugin_libraries, citing the CVE. A gap in the fix is still open. The subscription creation utility creates replication slots using the built-in output plugin without checking the new parameter, so a dry-run mode succeeds and the conversion then fails. Hayato Kuroda of Fujitsu explained on the development mailing list that the command creates replication slots with the built-in output plugin without checking the configuration setting, meaning if the plugin name is not specified in the parameter, dry-run mode passes but actual conversion fails, which is surprising for users and should be avoided. A patch was under review and had not been committed as of September 4. CVE-2026-6471 remained absent from CISA's Known Exploited Vulnerabilities (KEV) catalog as of September 4, and The Hacker News found no proof-of-concept code for it in public repositories on the same date.

Until the update can be applied, Cyera said exposure can be reduced by stripping the REPLICATION attribute from accounts that do not need it, restricting replication entries in the host-based authentication configuration file to known addresses, blocking outbound SMB (port 445) and NFS (port 2049) traffic from database servers, and disabling autofs where it is not needed. For teams that run services backed by this open-source database, AEU-I offers security-first IT, infrastructure and consulting that can help review server settings and coordinate updates like this one.