12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover
A 12-year-old vulnerability in PostgreSQL, dubbed PostGREShell, allows low-privilege attackers to gain complete control over databases and servers. The flaw stems from a missing authorization check in the logical decoding process, enabling attackers with Replication privileges to execute arbitrary code and install backdoors. This vulnerability affects PostgreSQL versions from 9.4 through 18, and requires immediate patching to prevent exploitation.
PostgreSQL, a popular open-source relational database system, has a critical vulnerability (CVE-2026-6471) that could allow attackers to take over databases and servers. The vulnerability, known as PostGREShell, has existed since 2014 and is related to the database’s logical decoding process. PostgreSQL uses a replication protocol to synchronize multiple replicas of a primary database, requiring a ‘Replication’ account for this functionality, typically provided to backup tools, servers, and monitoring utilities.
Attackers with Replication privileges can exploit this flaw by loading plugins without validation, leveraging the `dlopen()` function to execute arbitrary files with the privileges of the postgres system user. The vulnerability is exacerbated by the fact that the plugin’s name is passed directly to the loader without any sanitization, allowing attackers to inject malicious code through carefully crafted plugin names, including those containing path traversal sequences and Windows UNC paths.
Once a malicious plugin is loaded, it can install a backdoor, enabling connections without passwords, copy itself to a stable location, and re-apply superuser privileges even if they are reverted. The plugin achieves this by manipulating the `pg_authid` catalog table, effectively granting permanent superuser access to the entire database.
PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24 have been patched. Organizations are strongly advised to update their PostgreSQL instances immediately, audit Replication accounts to remove the attribute from accounts that don't require it, and proactively monitor for potential exploitation attempts.