---

📌 Overview

CVE-2026-6471 is a PostgreSQL authorization vulnerability involving the logical decoding subsystem.

The vulnerability can allow a PostgreSQL role possessing the REPLICATION privilege, but lacking superuser privileges, to cause the PostgreSQL server to load an attacker-controlled library accessible to the PostgreSQL operating-system account.

Successful exploitation can result in arbitrary code execution with the privileges of the PostgreSQL server process.

This repository provides a safe detection PoC designed for authorized security assessments.

⚠️ No malicious shared library is loaded and no operating-system command is executed by the checker.

---

🎯 Vulnerability Information

Property	Value
CVE	CVE-2026-6471
Product	PostgreSQL
Component	Logical Decoding
CWE	CWE-862 — Missing Authorization
CVSS v3.1	7.2 High
Attack Vector	Network
Attack Complexity	Low
Privileges Required	High
User Interaction	None
Confidentiality	High
Integrity	High
Availability	High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

---

🚨 Security Impact

Under the vulnerable conditions, an attacker who already possesses a PostgreSQL account with the required replication capability may potentially cross the database-to-operating-system privilege boundary.

┌──────────────────────┐
│   PostgreSQL User    │
│  REPLICATION = YES   │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│   Logical Decoding   │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│ Missing Authorization│
│      Validation      │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│   Library Loading    │
└──────────┬───────────┘
           │
           ▼
┌──────────────────────┐
│ PostgreSQL OS User   │
└──────────────────────┘

Potential consequences

• Arbitrary code execution
• PostgreSQL server compromise
• Confidentiality loss
• Integrity loss
• Availability impact
• Potential lateral movement from the database host

The actual impact depends heavily on the privileges and filesystem permissions of the PostgreSQL operating-system account.

---

🧩 Affected Versions

The PostgreSQL project's security advisory identifies the following affected branches:

Branch	Affected	Fixed
PostgreSQL 14	< 14.24	14.24
PostgreSQL 15	< 15.19	15.19
PostgreSQL 16	< 16.15	16.15
PostgreSQL 17	< 17.11	17.11
PostgreSQL 18	< 18.6	18.6

Recommended action

Upgrade to the latest security release available for your PostgreSQL branch.

---

🛡️ Safe Detection

This project intentionally performs non-destructive checks only.

The checker should verify:

1. PostgreSQL server version
2. Current PostgreSQL role
3. Whether the role is a superuser
4. Whether the role has REPLICATION
5. Whether the installed version falls within an affected range

Example defensive query

SELECT
    version() AS postgres_version,
    current_user AS current_user,
    rolsuper AS is_superuser,
    rolreplication AS has_replication
FROM pg_roles
WHERE rolname = current_user;

Example output:

postgres_version : PostgreSQL 17.x
current_user     : security_audit
is_superuser     : f
has_replication  : t

A vulnerable version combined with REPLICATION privileges should be treated as requiring remediation.

---

🧪 Safe PoC Methodology

The PoC follows this workflow:

              ┌───────────────┐
              │ PostgreSQL    │
              │ Connection    │
              └───────┬───────┘
                      │
                      ▼
             ┌─────────────────┐
             │ Get Server      │
             │ Version         │
             └────────┬────────┘
                      │
                      ▼
             ┌─────────────────┐
             │ Check Current   │
             │ Role            │
             └────────┬────────┘
                      │
                      ▼
             ┌─────────────────┐
             │ Check           │
             │ REPLICATION     │
             └────────┬────────┘
                      │
                      ▼
             ┌─────────────────┐
             │ Compare Against │
             │ Fixed Releases  │
             └────────┬────────┘
                      │
              ┌───────┴────────┐
              ▼                ▼
        Potentially          Not
        Vulnerable         Affected

What the checker DOES NOT do

❌ Load an attacker-controlled .so
❌ Execute arbitrary SQL payloads
❌ Execute operating-system commands
❌ Spawn a reverse shell
❌ Modify PostgreSQL configuration
❌ Modify filesystem contents
❌ Create persistence
❌ Exploit production systems

This makes the checker suitable for controlled vulnerability assessment and inventory workflows.

---

💻 Usage

Clone the repository:

git clone https://github.com/<YOUR-USERNAME>/CVE-2026-6471.git
cd CVE-2026-6471

Install the required Python dependency:

python3 -m pip install psycopg2-binary

Run the checker:

python3 CVE-2026-6471.py

Example:

╔════════════════════════════════════════════════════╗
║             CVE-2026-6471 SAFE CHECK               ║
║       PostgreSQL Logical Decoding Audit            ║
╚════════════════════════════════════════════════════╝

[+] Connecting to PostgreSQL...
[+] Server version : PostgreSQL 17.x
[+] Current role   : security_audit
[+] Superuser      : False
[+] Replication    : True

[!] PostgreSQL version requires security update
[!] REPLICATION privilege detected

[!] POTENTIALLY VULNERABLE
[!] Upgrade PostgreSQL to a fixed release.

---

🔎 Manual Verification

Administrators can inspect replication-enabled roles with: