← Back to Feed

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

CVE-2026-6471

September 4, 2026 · The Hacker News · Severity: HIGH

PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. The flaw, tracked as CVE-2026-6471 (CVSS score: 7.2), has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014.

Key Takeaways

  • PostgreSQL fixed a 12-year-old logical decoding flaw CVE-2026-6471 that enabled unauthorized data replication.
  • The vulnerability allowed attackers with database access to exploit logical replication for privilege escalation.
  • Database administrators should update PostgreSQL installations and review replication configurations.
☕ Buy a Coffee