CVE-2026-6471

HighCVSS 7.2

Published: 13/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

42th percentile - higher than 42% of all known CVEs

Summary

Missing authorization in PostgreSQL logical decoding allows a non-superuser with REPLICATION privilege to dlopen any file visible to the OS account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account.

Risk Assessment

Risk of arbitrary code execution on the database server, potentially leading to full system compromise and data confidentiality breaches.

Recommendation

Update PostgreSQL to versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later, which include a fix for this vulnerability.

Original NVD description (English source)

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.