A flaw that has sat in PostgreSQL for over a decade lets anyone holding a low-privilege backup account load malicious code and promote themselves to full database superuser. Security firm Cyera, which named the issue PostGREShell, says the bug spans every supported version line and was patched only in the August release cycle.
Tracked as CVE-2026-6471 with a CVSS score of 7.2, the problem lives in logical replication. PostgreSQL loads output plugins to format database changes for external tools, and it normally restricts non-superusers from loading libraries from unsafe filesystem locations. Cyera researcher Vladimir Tokarev found that the replication code path never invokes that check, so a crafted plugin name containing paths, traversal sequences, or Windows UNC paths is passed straight to the library loader.
Code loaded that way runs inside the PostgreSQL server process with no sandbox, which lets an attacker write directly to the pg_authid catalog and flip every privilege flag. Cyera demonstrated backdoors that survive restarts, including passwordless connections and plugins that re-register themselves on every new backend. Windows systems are especially exposed because a malicious DLL can be hosted on a remote SMB server, removing the need to plant files on the target first.
The bug affects versions back to 9.4, released in 2014, and was confirmed on builds as new as 18.2. Fixes landed August 13 in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 after Cyera reported the issue in February.
Cyera urges database teams to patch immediately and to audit accounts carrying the REPLICATION attribute, since the role is routinely handed to backup tools, replicas, and monitoring pipelines. A VirusTotal hunt by the firm also surfaced 114 malicious PostgreSQL plugins in the wild, though none were tied directly to this vulnerability.
