PostgreSQL Replication Slot Created with Non-Standard Plugin (CVE-2026-6471)

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•2

Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.