Privilege escalation via default expression evaluation in pglogical (CVE-2026-50737)

When pglogical applies replicated changes for a row missing one or more columns, it evaluates the affected table's default expressions on the subscriber under the apply worker's privilege level, which is equivalent to a PostgreSQL superuser in default installations. A party controlling a publisher endpoint can exploit this to cause arbitrary functions to execute on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser privilege. This issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles. Affected versions: - All versions of pglogical 2.x prior to 2.4.8 We recommend updating to: 2.4.8. CVSS 9.0 · our assessment: act_now Reference: https://www.enterprisedb.com/docs/security/advisories/cve202650737/ Details: https://vuln.today/cve/CVE-2026-50737