Pglogical
Monthly
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.