--- title: Decade-old PostgreSQL flaw turns backup account into a... description: A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4... canonical: https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Decade-old PostgreSQL flaw turns backup account into a backdoor | daily.dev og:description: A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4... og:url: https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn og:image: https://api.daily.dev/og/posts/DfmGlzZWN.png og:image:alt: Decade-old PostgreSQL flaw turns backup account into a backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Decade-old PostgreSQL flaw turns backup account into a backdoor **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 1 upvotes · 0 comments ## Summary A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4 (2014). The flaw resides in logical replication's handling of output plugins, which bypass the check_restricted_library_name() security check meant to block loading libraries from unsafe filesystem locations. A low-privilege account with the REPLICATION attribute could exploit this to load malicious plugins, achieve remote code execution across Windows, Linux, and macOS, escalate to PostgreSQL superuser, and establish persistent backdoor access via authentication config changes or preloaded libraries. Windows systems are especially exposed since attackers can host malicious DLLs on remote SMB servers. The bug was reported to the PostgreSQL Security Team in February and patched on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Cyera Research found 114 malicious PostgreSQL plugins circulating in the wild, though none were directly linked to this CVE. Recommended mitigations include patching immediately, auditing REPLICATION-attribute accounts, restricting replication access, and blocking unnecessary outbound SMB/NFS connections. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-6471 in PostgreSQL and how does it work? CVE-2026-6471, dubbed PostGREShell, is a flaw in PostgreSQL's logical replication code path that fails to call the check_restricted_library_name() security check when loading output plugins. This lets a low-privilege account with the REPLICATION attribute supply a crafted plugin name containing filesystem paths, traversal sequences, or Windows UNC paths, causing PostgreSQL to load and execute arbitrary code inside the server process. _Teams running PostgreSQL replication pipelines track vulnerability writeups like this one on daily.dev before patching._ ### Which PostgreSQL versions are affected by the PostGREShell vulnerability and what versions fix it? PostgreSQL versions dating back to 9.4, released in 2014, are affected. Fixes were released on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24, so any supported installation should be upgraded to one of these patched releases immediately. _Anyone managing PostgreSQL upgrades keeps track of patch releases like these via daily.dev._ ### How can an attacker escalate from a PostgreSQL replication account to superuser using this exploit? An attacker with a low-privilege account holding the REPLICATION attribute can load a malicious output plugin that runs inside the PostgreSQL server process, operating outside the normal SQL permission model. From there, the plugin can manipulate internal PostgreSQL structures to modify authentication data and elevate to superuser, then establish persistence through altered auth config or preloaded libraries surviving restarts. _Security teams auditing replication accounts follow incident breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [How CVE-2026-20253 Turns Splunk’s PostgreSQL Sidecar Into an Open Door](https://daily.dev/posts/how-cve-2026-20253-turns-splunk-s-postgresql-sidecar-into-an-open-door-eoqau7eyh) · Latest Hacking News · 0 upvotes · 0 comments - [Why Use App-Level Auth When Every Database Has Auth? \(Splunk Enterprise CVE-2026-20253 Pre-Auth RCE\)](https://daily.dev/posts/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce--yw8r64g1b) · watchTowr Labs · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#postgresql](https://daily.dev/tags/postgresql) [View this post on daily.dev](https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Decade-old PostgreSQL flaw turns backup account into a backdoor","url":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn"},"datePublished":"2026-09-03T11:41:25.947Z","dateModified":"2026-09-03T12:02:17.894Z","description":"A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/93770ec811b229505b892df9ed1140d1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/93770ec811b229505b892df9ed1140d1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,postgresql","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Decade-old PostgreSQL flaw turns backup account into a backdoor"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-6471 in PostgreSQL and how does it work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-6471, dubbed PostGREShell, is a flaw in PostgreSQL's logical replication code path that fails to call the check_restricted_library_name() security check when loading output plugins. This lets a low-privilege account with the REPLICATION attribute supply a crafted plugin name containing filesystem paths, traversal sequences, or Windows UNC paths, causing PostgreSQL to load and execute arbitrary code inside the server process. Teams running PostgreSQL replication pipelines track vulnerability writeups like this one on daily.dev before patching."}},{"@type":"Question","name":"Which PostgreSQL versions are affected by the PostGREShell vulnerability and what versions fix it?","acceptedAnswer":{"@type":"Answer","text":"PostgreSQL versions dating back to 9.4, released in 2014, are affected. Fixes were released on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24, so any supported installation should be upgraded to one of these patched releases immediately. Anyone managing PostgreSQL upgrades keeps track of patch releases like these via daily.dev."}},{"@type":"Question","name":"How can an attacker escalate from a PostgreSQL replication account to superuser using this exploit?","acceptedAnswer":{"@type":"Answer","text":"An attacker with a low-privilege account holding the REPLICATION attribute can load a malicious output plugin that runs inside the PostgreSQL server process, operating outside the normal SQL permission model. From there, the plugin can manipulate internal PostgreSQL structures to modify authentication data and elevate to superuser, then establish persistence through altered auth config or preloaded libraries surviving restarts. Security teams auditing replication accounts follow incident breakdowns like this on daily.dev."}}]} ```