Affected Systems

PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Exploitation requires an account with REPLICATION attribute and wal_level=logical configuration. Flaw present since PostgreSQL 9.4 (2014).

Exploitation Status

No evidence of active exploitation. Proof-of-concept published by Cyera Research (PostGREShell). Not listed in CISA KEV catalog as of September 4, 2026.

Business Impact

Accounts with REPLICATION attribute (commonly used by backup tools, standby servers, CDC pipelines, and monitoring systems) can execute arbitrary code as the postgres OS user. Attacker can escalate to PostgreSQL superuser, establish persistence, and compromise database integrity. CVSS 7.2 (High). Exploitation requires existing REPLICATION credentials, limiting immediate risk to environments where such accounts exist and wal_level=logical is enabled.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Identify output plugins in use by running: SELECT DISTINCT plugin FROM pg_replication_slots WHERE plugin IS NOT NULL; on all PostgreSQL instances before patching
  • Update to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 immediately on systems with wal_level=logical and REPLICATION-attributed accounts
  • Add non-default output plugins (e.g., wal2json, decoderbufs) to the new output_plugin_libraries parameter and reload configuration with pg_ctl reload or SELECT pg_reload_conf(); restart not required
  • Audit accounts with REPLICATION attribute and review access controls; rotate credentials if compromise is suspected
  • Before running pg_upgrade from version 17 or later, set output_plugin_libraries to include all plugins from the old cluster to avoid migration failures