Some bugs are newborns, barely a CVE number old. This one has been quietly aging in PostgreSQL's basement since 2014, waiting patiently for someone to notice it could turn a routine backup account into a database emperor.
How "Replication" Became "Root Access"
Researchers disclosed CVE-2026-6471, nicknamed PostGREShell, a flaw in PostgreSQL's logical decoding feature that's been present since it was introduced in version 9.4 back in 2014. Any account holding the REPLICATION attribute can exploit a path-traversal bug in how the replication protocol parses plugin names, tricking the server into loading an arbitrary library as an output plugin — on Windows, it can even fetch that malicious library over SMB from an attacker-controlled machine without dropping a single file locally.
The result is code execution, permanent superuser privileges, and a persistent backdoor, all from an account that was only supposed to be allowed to read the replication stream. It carries a CVSS score of 7.2 and affects every PostgreSQL version from 9.4 through 18 — that's twelve years of shipping software with the door unlocked.
Why Your Backup Tool Might Be the Weak Link
The REPLICATION attribute sounds like a niche admin permission, but backup tools, standby servers, change-data-capture pipelines, and monitoring systems routinely carry it as a matter of course. That means the blast radius here isn't "rogue DBA" — it's "whatever automated service you forgot was even touching your database."
Fixes are out now in versions 18.6, 17.11, 16.15, 15.19, and 14.24, adding a new output_plugin_libraries parameter that whitelists exactly which plugins are allowed to load. Patching alone isn't the full job, though — anyone running PostgreSQL should also audit existing replication slots for plugins nobody remembers approving.
Twelve years is long enough for a vulnerability to get a mortgage. Time to evict this one.
If you're not sure whether some quietly over-privileged account is sitting in your own infrastructure right now, WTK's free developer security checklist is a solid place to start looking.
Source: The Hacker News