Affected Systems

PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Exploitation requires an account with REPLICATION attribute and server running with wal_level=logical. Affects backup tools, standby servers, CDC pipelines, and monitoring systems that commonly hold REPLICATION privileges.

Exploitation Status

Proof-of-concept published by Cyera Research (PostGREShell). No evidence of active exploitation in the wild. Not listed in CISA KEV catalog as of September 4, 2026. Exploitation requires existing REPLICATION account access.

Business Impact

CVSS 7.2 (High). Accounts with REPLICATION attribute can execute arbitrary code as the postgres OS user, escalate to PostgreSQL superuser, and establish persistence mechanisms. Windows systems are at higher risk due to SMB-based remote library loading without writing to disk. Linux/macOS require NFS automounting or existing file write capability. REPLICATION accounts are common in production environments for backup, replication, and CDC operations, expanding attack surface.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Identify plugins in use before patching: run 'SELECT DISTINCT plugin FROM pg_replication_slots WHERE plugin IS NOT NULL;' on all PostgreSQL instances
  • Update to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 immediately
  • Add non-default plugins (wal2json, decoderbufs, etc.) to output_plugin_libraries parameter and reload configuration with 'pg_ctl reload' or 'SELECT pg_reload_conf();'
  • For pg_upgrade migrations from version 17+, set output_plugin_libraries before running pg_upgrade --check to avoid migration failures
  • Review and audit all accounts with REPLICATION attribute; restrict to minimum necessary systems and enforce network segmentation to prevent SMB/NFS-based remote library loading