CVE-2025-2506: Medium severity edb pglogical vulnerability
When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5. To exploit the vulnerability the attacker needs at least CONNECT permissions to a database configured for replication and must understand a number of pglogical3/BDR specific commands and be able to decode the binary protocol.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2506?
CVE-2025-2506 has been classified as a high severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2025-2506?
To mitigate CVE-2025-2506, ensure that pglogical verifies its replication connection before executing commands.
What products are affected by CVE-2025-2506?
CVE-2025-2506 affects EDB pglogical version 3.0 and later, as well as EDB BDR versions 4.0 to 5.0.
What is the impact of CVE-2025-2506?
The impact of CVE-2025-2506 allows users with CONNECT access to replicate databases to execute commands that grant read access to replicated tables.
Is there a workaround for CVE-2025-2506?
A recommended workaround for CVE-2025-2506 includes restricting CONNECT access to only trusted users who require it for database operations.