Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice…

High CVSS 7.2

CVECVE-2026-6471

First seen2026-08-14 06:16 UTC

Disclosed2026-08-13 13:19 UTC

Last updated2026-08-14 06:16 UTC

Channel statusauto

Summary

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://www.postgresql.org/support/security/CVE-2026-6471/

Timeline

2026-08-14 nvd_ingest NVD