CVE Tools
Track your stack

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

SecurityWeekBy Ionut Arghire

PatchPostgreSQL

Our summary

Cyera researchers disclosed a high-severity flaw, tracked as CVE-2026-6471 (CVSS 7.2) and dubbed "PostGREShell," affecting all PostgreSQL releases from 2014 onward. This unauthorized access issue exists within the logical decoding mechanism, allowing an attacker holding specific Replication privileges to execute arbitrary code on the server operating system. By exploiting the defect, threat actors can escalate permissions to full superuser status, extract sensitive data, and establish persistent backdoors. The PostgreSQL Global Development Group has resolved the vulnerability in recent point releases, specifically versions 18.6, 17.11, 16.15, 15.19, and 14.24.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and MoreCVE-2026-6471
  2. The Hacker NewsPostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code ExecutionCVE-2026-6471

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store