Vulnerabilities

PostGREShell Turns a Replication Account Into a Database Backdoor

September 6, 2026September 6, 2026

2 mins

The Mess: A PostgreSQL vulnerability dating back to 2014 can turn a low-privileged REPLICATION account into arbitrary code execution on the database server.

Tracked as CVE-2026-6471, PostGREShell abuses missing authorization in logical decoding. An attacker with the REPLICATION privilege can load an arbitrary library visible to the PostgreSQL operating-system account and execute code as that user.

The Damage: The attacker can escalate to PostgreSQL superuser, access databases, execute OS-level code and establish persistent access.

That’s particularly ugly because replication credentials are commonly used by backup systems, standby servers, CDC pipelines and monitoring tools. The privilege isn’t normally granted to ordinary users, but once a replication credential is compromised, the database has another problem to solve.

The flaw affects PostgreSQL versions before 18.6, 17.11, 16.15, 15.19 and 14.24. PostgreSQL added an allowlist for logical decoding output-plugin libraries as part of the fix.

The Fix: Upgrade to a fixed PostgreSQL release and audit every account with REPLICATION privileges, especially backup and CDC credentials.

Until patched, remove unnecessary REPLICATION privileges and restrict replication connections in pg_hba.conf to trusted sources.

Bugstoday’s Opinion

Twelve years.

That’s how long a dangerous assumption sat inside one of the Internet’s most widely deployed databases.

The bug doesn’t give an unauthenticated stranger instant access. It does something more interesting: it turns a credential that administrators already trust into a path toward database superuser and OS-level code execution.

Replication accounts deserve the same scrutiny as administrator accounts.

Treating them as harmless infrastructure plumbing is how PostGREShell happened.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources