The vulnerability, tracked as CVE-2026-6471, affects PostgreSQL versions dating back to 9.4, released in 2014, and was patched in all supported PostgreSQL releases, including versions 18.6, 17.11, 16.15, 15.19, and 14.24, released on August 13.
While PostgreSQL installations across Windows, Linux, and macOS were affected, the conditions needed to achieve code execution vary by platform, Tokarev noted.
Existing protections were not enough
The problem comes from PostgreSQL’s handling of output plugins used by logical replication. These plugins are compiled code that PostgreSQL loads to format database changes for external systems and tools.
