Skip to content
VulniPulse
Sign in
Advisory severityHigh7.2Red Hat Linux

High [CVE-2026-6471] Arbitrary code execution via logical decoding plugin

This high-severity Red Hat Linux advisory covers CVE-2026-6471 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-6471 Source published Source updated

VulniPulse record published Record updated

CVE-2026-6471
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account.

Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL.

Exploitation requires an attacker to already have significant access to the database, specifically the REPLICATION role, which is not granted by default to typical users, thus reducing the overall risk. Red Hat severity: Important — CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Weakness: CWE-94.

Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 10 more.

Affected versions
  • < 18.5
  • < 17.11
  • < 16.15
  • < 15.19
  • < 14.24

Official advisory · high-confidence parse· fetched 20 days ago·verify at source

Fixed versions
  • postgresql18-0:18.6-1.el10_2
  • postgresql16-0:16.15-1.el10_2
  • postgresql16-0:16.15-1.el10_0
  • postgresql:16-8100020260910192321.489197e6
  • postgresql:15-8100020260906175012.489197e6
  • postgresql:12-8100020260917081510.489197e6
  • postgresql:12-8040020260924163759.522a0ee4
  • postgresql:12-8060020260923144955.ad008a3a
  • postgresql:15-8080020260921162003.63b34585
  • postgresql:12-8080020260923144922.63b34585
  • postgresql:16-9080020260907191505.rhel9
  • postgresql:18-9080020260914093252.rhel9
  • postgresql-0:13.23-6.el9_8
  • postgresql:15-9080020260903073937.rhel9
  • postgresql:15-9020020260917092006.rhel9
  • postgresql-0:13.23-1.el9_2.5
  • postgresql:15-9040020260917091622.rhel9
  • postgresql:16-9040020260922062609.rhel9
  • postgresql-0:13.23-1.el9_4.4
  • postgresql:15-9060020260917102335.rhel9
  • postgresql:16-9060020260921091101.rhel9
  • postgresql-0:13.23-1.el9_6.5
  • ansible-automation-platform/bootc-automation-portal-rhel9:1790657374
  • rhui5/rhua-rhel9:1790242004
  • RHSA-2026:67280
  • RHSA-2026:70186
  • RHSA-2026:72282
  • RHSA-2026:69876
  • RHSA-2026:69923
  • RHSA-2026:69924
  • RHSA-2026:73912
  • RHSA-2026:72363
  • RHSA-2026:70602
  • RHSA-2026:72362
  • RHSA-2026:67491
  • RHSA-2026:67848
  • RHSA-2026:69607
  • RHSA-2026:69914
  • RHSA-2026:70763
  • RHSA-2026:72361
  • RHSA-2026:70762
  • RHSA-2026:70856
  • RHSA-2026:72283
  • RHSA-2026:69698

Official advisory · high-confidence parse· fetched 20 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • To mitigate this vulnerability, ensure that the REPLICATION privilege is granted only to highly trusted database superusers. Regularly review user privileges to confirm that non-superuser accounts do not possess the REPLICATION privilege unless absolutely necessary and their activities are closely monitored. If logical decoding is not actively used, consider disabling it to further reduce the attack surface, though specific configuration steps for disabling logical decoding are beyond the scope of this mitigation.

Official advisory · high-confidence parse· fetched 20 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.