Vulnerabilities CVE-2026-6471

CVE-2026-6471

High

Open

TLP:CLEAR

PostgreSQL logical decoding can dlopen arbitrary file

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Details

CVSS Score: 7.2
EPSS Score ⓘ: 0.51%

41.2th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Confidence: 90%
Published: Aug 13, 2026
Last Modified: Aug 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.