Vulnerability · Published Jul 28, 2026 · Assigned by EDB
CVE-2026-50736
Critical 9.0
In plain English
A critical-severity SQL injection in pglogical from EnterpriseDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pglogical | no fix listed | DEBIAN-CVE-2026-50736 |
| Debian:13 | pglogical | no fix listed | DEBIAN-CVE-2026-50736 |
| Debian:14 | pglogical | 2.4.8-1 | DEBIAN-CVE-2026-50736 |
| Ubuntu:22.04:LTS | pglogical | no fix listed | UBUNTU-CVE-2026-50736 |
| Ubuntu:24.04:LTS | pglogical | no fix listed | UBUNTU-CVE-2026-50736 |
| Ubuntu:26.04:LTS | pglogical | no fix listed | UBUNTU-CVE-2026-50736 |
| Ubuntu:26.10 | pglogical | no fix listed | UBUNTU-CVE-2026-50736 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EnterpriseDB | pglogical | 2 – before 2.4.8 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H