high CVSS 7.2 EPSS 0.53%

CVE-2026-6471·PostgreSQL vulnerability

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.53% — higher than 43% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-6471 scores 7.2 on CVSS, so a successful attack would be serious — but at 0.53%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

Upgrade PostgreSQL immediately to version 18.6 or later to close a privilege escalation gap in logical decoding plugin handling. Organizations running PostgreSQL 18.0–18.5 should prioritize this update, as it prevents users with REPLICATION privileges from loading arbitrary dynamic libraries and executing code with server account permissions.

sudo dnf update postgresql-server-18.6

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed PostgreSQL version: SELECT version();
  2. Verify REPLICATION privilege holders: SELECT usename FROM pg_user WHERE usesuper = false AND usereplication = true;
  3. Review logical decoding plugin directory permissions: ls -la /usr/lib/postgresql/18/lib/ | grep decoding
  4. Confirm patch installation: SELECT version(); should show version 18.6 or higher

FAQ

What is CVE-2026-6471?

This vulnerability allows database users with REPLICATION privileges—but not superuser status—to bypass authorization controls and load arbitrary shared libraries through logical decoding plugins, executing code with the privileges of the PostgreSQL system account.

Is CVE-2026-6471 being actively exploited?

No, according to CISA KEV data, this vulnerability is not currently being actively exploited in the wild, and no public exploits have been disclosed.

What versions of PostgreSQL are affected by CVE-2026-6471?

PostgreSQL versions 14.x before 14.24, 15.x before 15.19, 16.x before 16.15, 17.x before 17.11, and 18.0 through 18.5 are vulnerable.

How do I check if my server is vulnerable to CVE-2026-6471?

Run SELECT version(); in psql—if the output shows PostgreSQL 18.5 or earlier, you are vulnerable. Cross-reference with SELECT usename FROM pg_user WHERE usereplication = true; to identify which non-superuser accounts hold replication privileges.

Does Defensia detect CVE-2026-6471?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6471 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-15741CVSS 8.8SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6471. Free for 1 server.

Get started free