PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL has released a security update (version 18.6 and earlier) to address a 12-year-old vulnerability (CVE-2026-6471) that allowed a replication user with the REPLICATION attribute to execute arbitrary code on the database server. The flaw stems from a logical decoding feature introduced in 2014, and attackers could leverage this to gain superuser privileges. The fix involves a new server parameter, `output_plugin_libraries`, to whitelist allowed output plugins, and administrators are advised to identify existing plugins and add them to the list before updating.
PostgreSQL has released a critical security update to address a long-standing vulnerability, CVE-2026-6471, that could allow an attacker to execute arbitrary code on a database server. This flaw, present since logical decoding was introduced in PostgreSQL 9.4 in 2014, stems from a replication user possessing the REPLICATION attribute. The vulnerability arises because the replication protocol's parser accepts almost any character inside a double-quoted plugin name, including path separators and ../ traversal, so a full filesystem path reaches the loader as typed.
Exploitation requires an account carrying the REPLICATION attribute and a server running with wal_level = logical. The fix involves a new server parameter, `output_plugin_libraries`, which administrators must configure to whitelist allowed output plugins. Previously, replication users were not subject to restrictions on output plugin paths, allowing them to bypass LOAD-time protections. To mitigate the risk, PostgreSQL recommends stripping the REPLICATION attribute from accounts that don't need it, restricting replication entries in pg_hba.conf to known addresses, blocking outbound SMB (port 445) and NFS (port 2049) traffic from database servers, and disabling autofs where it is not needed. The update is available for versions 14 through 18, and PostgreSQL 14 will no longer receive fixes after November 12, 2026. A gap remains in the fix, as `pg_createsubscriber` creates replication slots using `pgoutput` without checking the new parameter, leading to a successful dry-run but a subsequent conversion failure. As of September 4, the vulnerability was not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no proof-of-concept code was found in public repositories.