PostgreSQL has patched a vulnerability that sat unnoticed in its logical decoding feature for twelve years. Tracked as CVE-2026-6471 and rated 7.2 on the CVSS scale, the flaw lets any account holding the REPLICATION attribute, not just a superuser, load an arbitrary file into the database server process through the choice of logical decoding plugin name. Because the replication protocol’s parser accepts slashes, directory traversal sequences, and even Windows UNC paths inside a quoted plugin name, an attacker with that one privilege can point the server at a file of their choosing and run code as the operating system account behind it.
The fix, shipped August 13 across PostgreSQL 14.24 through 18.6 and 19 Beta 3, adds a new server parameter, output_plugin_libraries, that restricts which libraries may load as output plugins at all, defaulting to the two built-in decoders. Until that patch is applied, the exposure sits behind an assumption most teams never questioned: that REPLICATION is a low-risk, infrastructure-only privilege. It routinely is not. Backup tools, standby servers, change-data-capture pipelines, and monitoring agents all carry it as a matter of course, which means the accounts that can trigger this flaw are often service accounts nobody flagged for extra scrutiny.
That is the real lesson here, not the twelve-year age of the bug. Logical decoding has existed since PostgreSQL 9.4 in 2014, and this is the first time its plugin-loading path has been shown to accept a full file system path rather than a registered plugin name. Security teams that inventory database privileges by role name rather than by what that role can actually reach should treat this as a prompt to re-audit every account carrying REPLICATION, particularly in managed CDC and backup tooling where the privilege is granted by default and rarely revisited.
Related on CyberTech: an unauthenticated flaw turned ordinary Git access into root access, and a separate maximum-severity bug sat in plain sight in Oracle WebLogic before reaching CISA’s exploited list.
