What Happened
Security researchers disclosed CVE-2026-6471, nicknamed PostGREShell, a missing-authorization flaw in PostgreSQL’s logical decoding feature carrying a CVSS score of 7.2. Any account holding the REPLICATION privilege on a server running with wal_level set to logical selects the logical decoding output plugin, and the flaw lets the account point PostgreSQL at an arbitrary file on the host and load it with dlopen, running code as the operating system account behind the database. The bug has existed since PostgreSQL 9.4 introduced logical decoding in 2014, affecting every release through version 18. The PostgreSQL project patched the issue in versions 18.6, 17.11, 16.15, 15.19, and 14.24. No public proof-of-concept code or evidence of exploitation had surfaced as of September 4, and CISA has not added the flaw to its Known Exploited Vulnerabilities catalog. Details are available from SecurityWeek.
Why This Matters for Canadian Organizations
PostgreSQL runs behind a large share of Canadian government portals, fintech platforms, SaaS products, and university systems, often provisioned with a replication account for backup or read-replica purposes with little thought given to what the privilege truly grants. A successful attack yields a persistent backdoor with restored superuser access surviving password resets, a serious problem for regulated sectors facing OSFI Guideline B-13 or PIPEDA breach-notification obligations if attacker access to a production database goes undetected for weeks or months. The twelve-year age of the flaw underscores how a design decision made during a feature’s original release sits unexamined for over a decade before drawing scrutiny.
What to Do
Inventory every PostgreSQL account holding the REPLICATION attribute and remove it from accounts not performing legitimate replication or backup work. Apply the patched versions and configure the new output_plugin_libraries parameter to allow-list approved logical decoding plugins once upgraded. Restrict replication entries in pg_hba.conf to known, trusted addresses, and block outbound SMB and NFS traffic from database servers to limit what an attacker-controlled plugin path reaches. Teams running managed PostgreSQL through a cloud provider should confirm whether the vendor already deployed the fix rather than assuming managed services patch automatically. Full remediation guidance is available from The Hacker News.
