PostgreSQL CREATE_REPLICATION_SLOT with Path-Traversal Plugin Name

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•2

This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.