CVE-2026-6471: PostgreSQL logical decoding can dlopen arbitrary file
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6471?
CVE-2026-6471 has a high severity rating of 7.2.
What does CVE-2026-6471 affect?
CVE-2026-6471 affects PostgreSQL logical decoding functionality.
How can I fix CVE-2026-6471?
Fix CVE-2026-6471 by upgrading PostgreSQL to the latest version that addresses this vulnerability.
What risks are associated with CVE-2026-6471?
CVE-2026-6471 allows a non-superuser with REPLICATION privilege to execute arbitrary code on the operating system.
Who is impacted by CVE-2026-6471?
Any PostgreSQL users with REPLICATION privileges may be impacted by CVE-2026-6471.