PostgreSQL pg_authid Catalog Modified to Grant Superuser (CVE-2026-6471)

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•4

Detects attempts to modify internal PostgreSQL system catalog tables (pg_authid or pg_proc) to grant superuser privileges or alter authorization records. This activity is commonly associated with exploiting logical decoding plugins to achieve persistence or privilege escalation in PostgreSQL environments.