PostGREShell (CVE‑2026‑6471) Enables Low‑Privileged Replication Accounts to Take Over PostgreSQL Servers
What It Is — A newly disclosed PostgreSQL flaw (CVE‑2026‑6471, CVSS 7.2) that lets an attacker with the built‑in REPLICATION privilege load an arbitrary shared‑object plugin and execute code as the OS account running the database.
Exploitability — Public proof‑of‑concept exists; the vulnerability has been present since 2014 and is exploitable on all supported PostgreSQL versions prior to the patches released in 2024‑2026.
Affected Products — PostgreSQL 9.4 through 14.23, 15.18, 16.14, 17.10, 18.5 (all platforms).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw shows how a “backup” or replication account can become a privileged escalation path if least‑privilege principles are not enforced.
- Continuous monitoring – Detecting unexpected plugin loads or anomalous replication‑slot activity is essential evidence for audit readiness.
- Defensible audit trail – Logging of privileged actions and plugin usage provides the provenance needed to demonstrate control effectiveness to regulators and enterprise buyers.
Recommended Actions
- Apply the PostgreSQL patches (≥ 14.24, 15.19, 16.15, 17.11, 18.6) immediately.
- Review all accounts with REPLICATION rights; restrict to only those required for genuine backup/replication workloads.
- Harden the plugin directory: allow only signed, admin‑approved plugins and enforce OS‑level file‑system permissions.
- Enable and centralise logging of logical‑decoding plugin loads and replication‑slot creation; feed these logs into a continuous‑monitoring solution.
- Capture remediation evidence (patch version, privileged‑account inventory, log‑ingestion config) for compliance audits.
Source: Security Affairs – PostgreSQL Hit by 12‑Year‑Old Vulnerability Allowing Server Takeover