Arbitrary SQL execution as superuser via pglogical queue (CVE-2026-50736)

The pglogical queue mechanism executes message payloads on subscriber nodes at superuser privilege level. A party controlling a publisher endpoint can send crafted queue messages to cause arbitrary SQL execution on the subscriber as superuser, escalating from a non-superuser pglogical role to full superuser. This is most impactful in managed deployments where subscription creation has been delegated to non-superuser roles, breaking tenant isolation. Affected versions: - All versions of pglogical 2.x prior to 2.4.8 We recommend updating to: 2.4.8. CVSS 9.0 · our assessment: act_now Reference: https://www.enterprisedb.com/docs/security/advisories/cve202650736/ Details: https://vuln.today/cve/CVE-2026-50736