Ethical Hacking News
A recent patch has been released for PostgreSQL, addressing a 12-year-old vulnerability that could have been exploited by an attacker with the REPLICATION attribute to execute arbitrary code as the operating-system user running the database server.
PostgreSQL has released a patch to address a 12-year-old vulnerability (CVE-2026-6471) that could allow an attacker to execute arbitrary code as the operating-system user running the database server. The vulnerability was introduced in PostgreSQL 9.4 in 2014 and affects versions 14.24, 15.19, 16.15, 17.11, and 18.6. The patch adds a server parameter called output_plugin_libraries that lists which libraries may be loaded as logical decoding output plugins, defaulting to 'pgoutput, test_decoding'. Administrators are advised to update to the affected version, identify the output plugins in use, and add any non-default plugins to the output_plugin_libraries parameter. Fixed packages are available for Amazon RDS, Debian, SUSE, and Ubuntu. Exposure can be reduced by stripping the REPLICATION attribute from accounts that do not need it, restricting replication entries in pg_hba.conf, and blocking outbound SMB and NFS traffic. A gap in the fix remains open, where the pg_createsubscriber command creates replication slots without checking the new parameter.
A recent patch has been released for PostgreSQL, addressing a 12-year-old vulnerability that could have been exploited by an attacker with the REPLICATION attribute to execute arbitrary code as the operating-system user running the database server. The vulnerability, tracked as CVE-2026-6471, has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014.
According to the PostgreSQL Global Development Group, the vulnerability was addressed by adding a server parameter called output_plugin_libraries that lists which libraries may be loaded as logical decoding output plugins, defaulting to 'pgoutput, test_decoding'. Installations using any other output plugin will have logical decoding refused after updating until an administrator adds the library to that list and reloads the server configuration.
The PostgreSQL Project credited Vladimir Tokarev and Yu Kunpeng with reporting the problem, which was detailed in a September 1 write-up for data security firm Cyera Research. The plugin name supplied in a CREATE_REPLICATION_SLOT command is passed directly to the function that loads the library, Cyera said. PostgreSQL's existing restriction on plugin paths, which confines non-superusers to a single administrator-controlled directory, is never called on the replication path. The replication protocol's parser accepts almost any character inside a double-quoted plugin name, including path separators and ../ traversal, so a full filesystem path reaches the loader as typed.
On Windows, the server resolves a network path over Server Message Block (SMB) and fetches the library from a machine the attacker controls, writing nothing to the target, Cyera said. On Linux and macOS, the same result requires enabling Network File System (NFS) automounting. Everywhere else the attacker needs an existing way to write a file to the server's disk. Code loaded this way runs inside the database backend process as the postgres operating-system user.
The flaw, tracked as CVE-2026-6471, has been present since logical decoding was introduced in PostgreSQL 9.4 in 2014. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. Exploitation requires an account carrying the REPLICATION attribute and a server running with wal_level = logical. Backup tools, standby servers, change data capture (CDC) pipelines, and monitoring systems routinely hold that attribute.
The fix, shipped on August 13, adds a server parameter called output_plugin_libraries that lists which libraries may be loaded as logical decoding output plugins, defaulting to 'pgoutput, test_decoding'. Installations using any other output plugin will have logical decoding refused after updating until an administrator adds the library to that list and reloads the server configuration.
Administrators are advised to take the following steps - Run SELECT DISTINCT plugin FROM pg_replication_slots WHERE plugin IS NOT NULL; before updating to identify the output plugins in use, which will only show plugins successfully used at some point. Update to 18.6, 17.11, 16.15, 15.19, or 14.24, or to the equivalent distribution package. Add any non-default plugin to output_plugin_libraries and reload the configuration with pg_ctl reload or SELECT pg_reload_conf(). A restart is not required.
Fixed packages are available on Amazon RDS for all five branches, as well as from Debian, SUSE, and Ubuntu. PostgreSQL's advisory covers supported branches 14 through 18 and does not address earlier ones. PostgreSQL 14 stops receiving fixes on November 12, 2026, the project said in its release announcement.
The upstream fix requires additional changes to the configuration if some extensions are used, Debian's advisory warns, naming its wal2json and decoderbufs packages. Ubuntu's USN-8653-1, which shipped the fix for 22.04, 24.04, and 26.04 LTS on August 20, makes no mention of the parameter and tells administrators only to restart PostgreSQL after the update.
As of September 4, the wal2json project had updated its documentation to tell users to add the plugin to output_plugin_libraries, citing the CVE. A gap in the fix is still open. pg_createsubscriber creates replication slots using pgoutput without checking the new parameter, so a --dry-run succeeds and the conversion then fails. "pg_createsubscriber command creates replication slots with plugin 'pgoutput', without checking the GUC. This meant if the plugin name is not specified in the parameter, --dry-run mode passes but actual convertion fails. It's very surprising for users and should be avoided," Hayato Kuroda of Fujitsu said in a message to the pgsql-hackers mailing list.
The Hacker News found no proof-of-concept code for it in public repositories on the same date. Until the update can be applied, Cyera said exposure can be reduced by stripping the REPLICATION attribute from accounts that do not need it, restricting replication entries in pg_hba.conf to known addresses, blocking outbound SMB (port 445) and NFS (port 2049) traffic from database servers, and disabling autofs where it is not needed.
Related Information:
https://www.ethicalhackingnews.com/articles/PostgreSQL-Fixes-12-Year-Old-Vulnerability-Allowing-Arbitrary-Code-Execution-ehn.shtml
https://thehackernews.com/2026/09/postgresql-fixes-12-year-old-logical.html
https://nvd.nist.gov/vuln/detail/CVE-2026-6471
https://www.cvedetails.com/cve/CVE-2026-6471/
Published: Fri Sep 4 13:08:40 2026 by llama3.2 3B Q4_K_M
