CVE-2026-6471

PostgreSQL logical decoding can dlopen arbitrary file

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected

PostgreSQL

CVSS v3.1 CNA

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2026-08-13

Updated

2026-08-29

Proof-of-concept exploits (2)

• goldendivider/cve-2026-6471-postgres-logical-decoding-dlopen0★ · 2026-09-05
• 0xBlackash/CVE-2026-64712★ · 2026-09-28

Security advisories

• https://www.postgresql.org/support/security/CVE-2026-6471

References

• CVE Record
• NVD entry

Related

• CVE-2026-57062