PostgreSQL CVE-2026-6471: Replication Role Enables OS Code Execution

Sat, 05 Sep 2026 13:51:48 +0000

Engineer — Plan: A public PoC exists but EPSS is near zero and it is not KEV-listed; exploitation requires REPLICATION attribute (a non-default privilege), so immediate fire-drill pressure is low. Patch PostgreSQL to 18.6, 17.11, 16.15, 15.19, or 14.24, and audit which accounts hold the REPLICATION attribute in your instances.
SOC/IR — Learn: No active exploitation is reported and no IOCs are available; the public PoC is useful context for understanding how a compromised REPLICATION account could achieve OS-level execution, informing future detection logic around abnormal logical decoding activity, but no immediate hunt is warranted.
Leader — Skip
Signals: CVE-2026-6471 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub

Postgresql on CuraSec