Cyera Uncovers 12-Year-Old PostgreSQL RCE Vulnerability PostGREShell
A PostgreSQL RCE vulnerability that remained in the database platform for more than a decade could allow an attacker with a routine replication account to execute code on the underlying server and escalate to PostgreSQL superuser privileges.
Cyera Research dubbed the vulnerability PostGREShell. It is tracked as CVE-2026-6471 and affects PostgreSQL versions dating back to version 9.4, released in 2014.
The important part is not simply that PostgreSQL could execute malicious code. It is who could trigger it.
An attacker does not initially need database administrator or superuser access. According to Cyera, an account with the REPLICATION privilege — routinely used for backups, standby replicas and Change Data Capture — can reach a plugin-loading path that did not apply the same security restrictions used elsewhere in PostgreSQL.
That turns a credential many organisations may consider operational plumbing into something far more dangerous.
PostgreSQL RCE Vulnerability Abuses Replication Accounts
PostgreSQL replication accounts are common across production environments.
Backup services, disaster recovery systems, standby databases and CDC tools frequently use accounts carrying the REPLICATION attribute. Their purpose is to synchronise database changes, not administer the database or execute programs.
Cyera found that logical replication allowed the user to specify an output plugin when creating a replication slot.
PostgreSQL normally restricts where non-superusers can load plugins from. However, the researchers found that the logical replication path failed to apply that security check.
As a result, an attacker could potentially supply a filesystem path rather than the name of a legitimate PostgreSQL plugin.
The vulnerability ultimately comes down to a validation step that existed elsewhere in PostgreSQL but was not applied to this code path. Cyera says the issue had been present since 2014.
Windows Systems Face the Most Direct Attack Path
Cyera says Windows presents the clearest remote exploitation scenario.
Windows supports UNC network paths such as \\server\share\file. Under the vulnerable PostgreSQL behaviour, an attacker could point the plugin loader at a DLL hosted on an external SMB server.
PostgreSQL could then cause Windows to retrieve and load that library over the network.
The attacker would need a PostgreSQL account with the REPLICATION attribute, logical replication enabled through wal_level = logical, and outbound SMB connectivity from the database server.
Linux and macOS systems can also be remotely exploitable where NFS automounting is enabled. Other Linux, Docker, and Kubernetes environments generally require the attacker to find another way to place a malicious library on the local filesystem first.
PostGREShell Can Escalate to PostgreSQL Superuser
Remote code execution is only the first stage.
Once malicious code runs inside the PostgreSQL process, Cyera demonstrated that it could interact directly with PostgreSQL’s internal functions and system catalogues.
The researchers were able to turn the original replication account into a permanent PostgreSQL superuser.
That changes the risk dramatically.
A PostgreSQL superuser can access databases and sensitive application data, modify roles, and reach privileged functionality capable of interacting with the underlying operating system.
Cyera’s research also demonstrated persistence mechanisms designed to survive restarts and administrative cleanup, including changes to PostgreSQL authentication configuration and the automatic loading of malicious libraries.
In other words, compromise does not necessarily disappear when the original account is removed.
Cyera Finds 114 Malicious PostgreSQL Plugins
During their research, Cyera searched VirusTotal for malicious PostgreSQL plugins and identified 114 samples, including cryptocurrency miners, trojans, and reverse shells.
That does not mean Cyera observed 114 attacks exploiting PostGREShell.
It does show that malicious PostgreSQL plugins already exist in the threat ecosystem, which makes a vulnerability capable of loading attacker-controlled plugins considerably more relevant than a purely theoretical attack.
Why the PostgreSQL RCE Vulnerability Matters
PostgreSQL is one of the world’s most widely deployed database platforms.
It ranks among the leading database technologies used by developers and underpins major applications, cloud services and enterprise infrastructure. Cyera says more than 39,000 organisations use PostgreSQL in production.
The vulnerable functionality is also not obscure.
Logical replication now supports common production workflows including Change Data Capture, cloud migrations, analytics pipelines and cross-region database synchronisation.
That combination — widespread deployment plus routine replication credentials — is what makes PostGREShell noteworthy.
The security lesson is also familiar: organisations tend to focus heavily on administrator accounts while assuming service accounts have limited blast radius.
PostGREShell demonstrates why that assumption deserves scrutiny.
How Organisations Should Respond to PostGREShell
Organisations running PostgreSQL should apply the security update addressing CVE-2026-6471 and identify every account with the REPLICATION privilege.
Cyera also recommends removing replication privileges where they are unnecessary and restricting legitimate replication accounts to trusted source addresses through pg_hba.conf.
Database servers should not have unrestricted outbound SMB or NFS access. Blocking SMB on port 445 and NFS on port 2049 can reduce exposure to the remote library-loading techniques described by the researchers.
Security teams should also monitor unusual replication activity, including unexpected CREATE_REPLICATION_SLOT commands, suspicious plugin names and new replication slots created from unfamiliar systems.
Existing PostgreSQL environments should be reviewed for more than just vulnerable software versions. Organisations concerned that credentials may already have been compromised should also inspect database roles, authentication configuration and loaded libraries for evidence of persistence.
PostgreSQL RCE Vulnerability Was Reported in February
Cyera Research Labs reported the vulnerability to the PostgreSQL Security Team on February 21, 2026.
On February 27, PostgreSQL’s Noah Misch confirmed:
“I agree this is a vulnerability. We’ll fix it.”
Cyera’s technical paper records the release of the CVE-2026-6471 patch on August 13, 2026.
Cyera Research Labs thanked Misch and the PostgreSQL Security Team for reviewing the vulnerability and coordinating the fix.
For a deeper technical breakdown of the PostgreSQL vulnerability, check out the full write-up.
Stay Informed With Cyber News Live
Cyber threats are constantly evolving, and staying informed is critical to protecting your organization.
Follow Cyber News Live for the latest cybersecurity news, threat intelligence, expert analysis, and practical guidance to help strengthen your cyber defenses.