Your PostgreSQL database has been a ticking time bomb for 12 years

Security researchers at Cyera Research have finally exposed a vulnerability dubbed PostGREShell (CVE-2026-6471). For over a decade, anyone with a REPLICATION privilege could trick the database into loading arbitrary libraries, essentially handing over control of the server to the attacker. The issue stems from a lack of validation in the logical decoding mechanism introduced way back in PostgreSQL 9.4.

Normally, a standard SQL LOAD command checks the library name for safety. However, the logical decoding protocol skipped this step entirely. Attackers could use this flaw to force the server to execute malicious code, and on Windows, they could even pull files from a remote SMB share. Once that code executes, it runs with the same high-level system permissions as the database itself.

Escalation to superuser status is trivial once the malicious library is loaded. Attackers can modify system catalogs like pg_authid, effectively granting themselves total control. VirusTotal scans have already turned up over a hundred malicious plugins disguised as database tools, proving that the "creative" side of the internet doesn't sleep.

The fix, now included in recent patches for PostgreSQL 18.6, 17.11, and others, introduces a strict allowlist called output_plugin_libraries. Only libraries explicitly named by the admin can be loaded, shutting the gate on the last 12 years of "unintended" flexibility. It is a harsh reminder that even the most trusted open-source pillars are just one forgotten line of validation away from becoming a security nightmare.

Source: Cyera Research