What is CVE-2026-6471?
CVE-2026-6471 is a missing authorization vulnerability in PostgreSQL's logical decoding, allowing a non-superuser with REPLICATION privilege to execute arbitrary code. The attacker can load any shared library visible to the server process via a chosen logical decoding plugin. Affected users should immediately apply security updates and restrict REPLICATION privileges.
Azərbaycanca: CVE-2026-6471 boşluğu PostgreSQL serverində logical decoding funksiyasında səlahiyyət yoxlamasının olmaması ilə bağlıdır. Bu, REPLICATION imtiyazına malik superuser olmayan istifadəçiyə server prosesi adından ixtiyari kod icra etməyə imkan verir. Təsirlənən istifadəçilər dərhal təhlükəsizlik yeniləməsini tətbiq etməli və REPLICATION imtiyazlarını məhdudlaşdırmalıdır.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
What specific privilege does an attacker need to have on the PostgreSQL server to exploit CVE-2026-6471?
To exploit this vulnerability, the attacker does not need to be a superuser; they only need to have the REPLICATION privilege.
What is the primary recommended action to mitigate the impact of CVE-2026-6471 for users?
Affected users should immediately apply security updates and restrict REPLICATION privileges.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.