Executive Summary
PostgreSQL has addressed a high-severity vulnerability, tracked as CVE-2026-6471 and dubbed 'PostGREShell,' which has existed since version 9.4 (released in 2014). The flaw resides in the logical decoding path, where the replication protocol fails to validate output plugin names. This oversight allows an attacker with basic REPLICATION privileges to bypass existing security restrictions and load malicious shared libraries directly into the database server process.
Technical analysis by Cyera Research confirms that attackers can achieve Remote Code Execution (RCE) and subsequent privilege escalation to superuser. On Windows, this is achieved via UNC paths over SMB, while Linux/macOS systems are vulnerable through NFS automounting or existing file-write access. Once executed, the malicious code can modify internal catalog tables to grant permanent administrative rights and install persistent backdoors that survive server restarts.
This vulnerability is critical due to the ubiquity of PostgreSQL and the standard use of replication accounts for backups, monitoring, and CDC pipelines. Organizations should prioritize updating to the latest minor releases (e.g., 18.6, 17.11) and audit their replication role assignments immediately.
Key Details
Threat Name
PostGREShell (CVE-2026-6471)
Affects
PostgreSQL versions before 18.6, PostgreSQL versions before 17.11, PostgreSQL versions before 16.15, PostgreSQL versions before 15.19, PostgreSQL versions before 14.24, PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL 9.4 through 18.2, AWS RDS, Azure Database, Google Cloud SQL, Supabase, Redis, PostgreSQL 9.4 through 18, PostgreSQL 18.2, Langflow, PostgreSQL versions prior to 18.6, PostgreSQL versions prior to 17.11, PostgreSQL versions prior to 16.15, PostgreSQL versions prior to 15.19, PostgreSQL versions prior to 14.24, WordPress plugin versions prior to 7.110, PostgreSQL 9.4 and later, PostgreSQL 14.x before 14.24, PostgreSQL 15.x before 15.19, PostgreSQL 16.x before 16.15, PostgreSQL 17.x before 17.11
Adversary
HeadCrab Other Adversaries and Aliases: Silk Typhoon
Malware/Tools
HeadCrab, RediShell, PostGREShell, HollowGraph, Pegasus, NoviSpy