CyberSecurity News

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

SecurityWeek

· September 4, 2026

AI summary

A 12-year-old vulnerability in PostgreSQL, known as CVE-2026-6471 or PostGREShell, allows attackers to gain code execution and permanent superuser privileges. This vulnerability can also create a persistent database backdoor. It exploits low-level replication access to achieve these outcomes, enabling database and server takeover. The vulnerability has been assigned the identifier CVE-2026-6471.

Vulnerabilities mentioned

CVE-2026-6471

HIGH

CVSS 7.2

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Read the full article at SecurityWeekwww.securityweek.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to SecurityWeek.