PostgreSQL Addresses 12-Year-Old Logical Decoding Privilege Escalation Flaw

PostgreSQL maintainers have released updates to address a security flaw that has existed for over a decade. The vulnerability, tracked as CVE-2026-6471, affects logical decoding functionality introduced in PostgreSQL 9.4 in 2014. An account possessing the REPLICATION attribute can exploit this flaw to execute arbitrary code as the operating-system user running the PostgreSQL server.

The issue impacts all supported PostgreSQL versions prior to the patched releases: versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable. The flaw's longevity underscores the importance of thorough security review during feature development, as the vulnerability has been present since logical decoding was introduced nearly 12 years ago.

As of the disclosure date, no public exploitation of CVE-2026-6471 has been confirmed. The PostgreSQL security team has released corresponding updates for all affected series to remediate the issue.