12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

Key Points:

• A severe vulnerability in PostgreSQL, tracked as CVE-2026-6471 (CVSS score of 7.2), allows attackers with low privileges to take over databases and servers through remote code execution and privilege escalation.
• The vulnerability affects all PostgreSQL versions from 9.4 to 18, enabling attackers with 'Replication' privileges to load arbitrary files and gain superuser access, potentially leading to data breaches and persistent backdoors.
• Organizations should promptly update PostgreSQL to patched versions (18.6, 17.11, 16.15, 15.19, and 14.24), audit their Replication accounts, and restrict the Replication attribute to necessary accounts only.

Technical Details: The vulnerability arises from a missing authorization in the logical decoding process, allowing attackers to exploit the replication protocol by loading malicious plugins via the dlopen() function without proper validation.

MITRE ATT&CK Techniques:

• T1068 - Exploit Public-Facing Application (Initial Access)
• T1060 - Registry Run Keys / Startup Folder (Persistence)
• T1210 - Exploitation of Remote Services (Execution)

IOCs Mentioned: None mentioned