--- title: Decade-old PostgreSQL flaw turns backup account into a... description: A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4... canonical: https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Decade-old PostgreSQL flaw turns backup account into a backdoor | daily.dev og:description: A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4... og:url: https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn og:image: https://api.daily.dev/og/posts/DfmGlzZWN.png og:image:alt: Decade-old PostgreSQL flaw turns backup account into a backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Decade-old PostgreSQL flaw turns backup account into a backdoor **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 4 upvotes · 0 comments ## Summary A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4 (2014). The flaw resides in logical replication's handling of output plugins, which bypass the check_restricted_library_name() security check meant to block loading libraries from unsafe filesystem locations. A low-privilege account with the REPLICATION attribute could exploit this to load malicious plugins, achieve remote code execution across Windows, Linux, and macOS, escalate to PostgreSQL superuser, and establish persistent backdoor access via authentication config changes or preloaded libraries. Windows systems are especially exposed since attackers can host malicious DLLs on remote SMB servers. The bug was reported to the PostgreSQL Security Team in February and patched on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Cyera Research found 114 malicious PostgreSQL plugins circulating in the wild, though none were directly linked to this CVE. Recommended mitigations include patching immediately, auditing REPLICATION-attribute accounts, restricting replication access, and blocking unnecessary outbound SMB/NFS connections. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-6471 in PostgreSQL and which versions are affected? CVE-2026-6471, dubbed PostGREShell by Cyera Research, is a flaw in PostgreSQL's logical replication output plugin loading that lets a low-privileged account with the REPLICATION attribute execute arbitrary code and escalate to superuser. It affects versions dating back to 9.4 (released 2014) and was patched on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24. _Teams running PostgreSQL in production track disclosures like this on daily.dev to patch before attackers move._ ### How does the PostgreSQL PostGREShell replication vulnerability actually work? An attacker with a REPLICATION-attribute account can create a logical replication slot and supply a crafted output plugin name containing path traversal sequences or, on Windows, UNC paths, because the replication code path never called PostgreSQL's check_restricted_library_name() safety check. PostgreSQL passes that name directly to the OS library loader, so a malicious library's initialization code executes inside the server process, and on Windows can even be hosted remotely via SMB. _Understanding exploit mechanics like this helps engineers evaluating database security harden configs faster, a use case daily.dev supports._ ### What should PostgreSQL administrators do to mitigate the PostGREShell replication vulnerability besides patching? Beyond applying the August patches, audit all accounts holding the REPLICATION attribute, restrict who can create replication slots, and block unnecessary outbound SMB and NFS connections from database servers, since Windows systems are especially exposed to remote malicious DLL hosting over SMB. Cyera also found 114 malicious PostgreSQL plugins in the wild during related threat hunting. _Ops teams hardening database access controls follow practical mitigation guidance like this on daily.dev._ ## Similar posts on daily.dev - [PostGREShell: A Decadelong PostgreSQL Vulnerability Revealed](https://daily.dev/posts/postgreshell-a-decadelong-postgresql-vulnerability-revealed-ewywwcoxd) · Medium · 2 upvotes · 0 comments - [Why Use App-Level Auth When Every Database Has Auth? \(Splunk Enterprise CVE-2026-20253 Pre-Auth RCE\)](https://daily.dev/posts/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce--yw8r64g1b) · watchTowr Labs · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#postgresql](https://daily.dev/tags/postgresql) [View this post on daily.dev](https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Decade-old PostgreSQL flaw turns backup account into a backdoor","url":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn"},"datePublished":"2026-09-03T11:41:25.947Z","dateModified":"2026-09-13T21:37:02.333Z","description":"A critical PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471, went unnoticed for over a decade, affecting versions dating back to 9.4...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/93770ec811b229505b892df9ed1140d1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/93770ec811b229505b892df9ed1140d1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,postgresql","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Decade-old PostgreSQL flaw turns backup account into a backdoor"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/decade-old-postgresql-flaw-turns-backup-account-into-a-backdoor-dfmglzzwn#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-6471 in PostgreSQL and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-6471, dubbed PostGREShell by Cyera Research, is a flaw in PostgreSQL's logical replication output plugin loading that lets a low-privileged account with the REPLICATION attribute execute arbitrary code and escalate to superuser. It affects versions dating back to 9.4 (released 2014) and was patched on August 13 in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Teams running PostgreSQL in production track disclosures like this on daily.dev to patch before attackers move."}},{"@type":"Question","name":"How does the PostgreSQL PostGREShell replication vulnerability actually work?","acceptedAnswer":{"@type":"Answer","text":"An attacker with a REPLICATION-attribute account can create a logical replication slot and supply a crafted output plugin name containing path traversal sequences or, on Windows, UNC paths, because the replication code path never called PostgreSQL's check_restricted_library_name() safety check. PostgreSQL passes that name directly to the OS library loader, so a malicious library's initialization code executes inside the server process, and on Windows can even be hosted remotely via SMB. Understanding exploit mechanics like this helps engineers evaluating database security harden configs faster, a use case daily.dev supports."}},{"@type":"Question","name":"What should PostgreSQL administrators do to mitigate the PostGREShell replication vulnerability besides patching?","acceptedAnswer":{"@type":"Answer","text":"Beyond applying the August patches, audit all accounts holding the REPLICATION attribute, restrict who can create replication slots, and block unnecessary outbound SMB and NFS connections from database servers, since Windows systems are especially exposed to remote malicious DLL hosting over SMB. Cyera also found 114 malicious PostgreSQL plugins in the wild during related threat hunting. Ops teams hardening database access controls follow practical mitigation guidance like this on daily.dev."}}]} ```