pglogical EUVD-2026-49938

The attacker must be an authenticated low-privileged PostgreSQL user with the permissions required to perform pglogical operations that influence worker lifecycle (starting, stopping, restarting replication). The vulnerability is only present when the pglogical extension is installed and replication workers are active. Exploitation demands careful timing to win the race condition; no default configuration enables it automatically.

CVSS 4.0 score 7.7 (High) with network attack vector, high attack complexity, low privileges required, and no user interaction. EPSS probability is not available. No KEV listing or public exploit code is identified at time of analysis. The high complexity (race condition) makes widespread exploitation difficult, but the potential for remote code execution elevates real-world risk for exposed databases. The lack of known active exploitation suggests targeted rather than opportunistic attacks, but the combination of low privilege requirement and network accessibility keeps the threat significant.

A low-privileged PostgreSQL user executes a series of allowed pglogical commands to start, stop, and restart a replication worker in rapid succession, creating a race condition where a freed worker structure is still referenced. This causes the worker to crash, and an attacker with precise timing can leverage the use-after-free to execute arbitrary code within the PostgreSQL backend process.