CVE-2026-120145: PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

Published Nov 12, 2026

Updated

Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are vulnerable?

Only logical replication subscriptions owned by a superuser are vulnerable. A subscription not owned by a superuser is not affected by this issue.

What does an attacker need to exploit this?

The attacker must have compromised the logical replication publisher. Exploitation relies on naming a system catalog as a replication target and can result in arbitrary code execution as the operating-system user running the superuser-owned subscription.

Which PostgreSQL releases contain the fix?

The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Versions before those releases are affected.