Vulnerability · Published Aug 13, 2026 · Assigned by PostgreSQL

CVE-2026-6471PostgreSQL logical decoding can dlopen arbitrary file

High 7.2

In plain English

A high-severity missing authorization in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pg_repack1.4.6-3.module_el8.9.0+3704+f1f917ceALSA-2026:69924
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4125+ceaf7d1bALSA-2026:69876
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4199+bf03c564ALSA-2026:69876
AlmaLinux:8pg_repack1.4.8-1.module_el8.9.0+3706+885c732eALSA-2026:69923
AlmaLinux:9pg_repack1.5.1-1.module_el9.6.0+146+c54fdecaALSA-2026:67491
AlmaLinux:9pg_repack1.5.3-1.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9pg_repack1.4.8-2.module_el9.5.0+119+18833d03ALSA-2026:69914
AlmaLinux:8pgaudit1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1ALSA-2026:69924
AlmaLinux:8pgaudit16.0-1.module_el8.10.0+3798+606ebb9fALSA-2026:69876
AlmaLinux:8pgaudit1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1ALSA-2026:69924
AlmaLinux:8pgaudit1.7.0-1.module_el8.9.0+3706+885c732eALSA-2026:69923
AlmaLinux:9pgaudit16.0-1.module_el9.4.0+66+eb9878bcALSA-2026:67491
AlmaLinux:9pgaudit1.7.0-1.module_el9.3.0+52+21733919ALSA-2026:69914
AlmaLinux:9pgaudit18.0-1.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9pgvector0.6.2-2.module_el9.6.0+167+4e561146ALSA-2026:67491
AlmaLinux:9pgvector0.8.1-1.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9postgis3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-client3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-client3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis-docs3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-docs3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis-upgrade3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis-upgrade3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-utils3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-utils3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:8postgres-decoderbufs1.9.7-1.Final.module_el8.9.0+3706+885c732eALSA-2026:69923
AlmaLinux:8postgres-decoderbufs2.4.0-1.Final.module_el8.10.0+3798+606ebb9fALSA-2026:69876
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.9.0+3704+f1f917ceALSA-2026:69924
AlmaLinux:9postgres-decoderbufs2.4.0-1.Final.module_el9.4.0+66+eb9878bcALSA-2026:67491
AlmaLinux:9postgres-decoderbufs3.3.1-1.Final.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9postgres-decoderbufs1.9.7-1.Final.module_el9.3.0+52+21733919ALSA-2026:69914
AlmaLinux:10postgresql16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:10postgresql-contrib16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-contrib12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-contrib15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-contrib16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-contrib13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-contrib18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-contrib15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-contrib16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-docs16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-docs12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-docs16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-docs15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-docs15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-docs18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-docs16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-docs13.23-6.el9_8ALSA-2026:69607
AlmaLinux:10postgresql-plperl16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-plperl16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-plperl15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-plperl12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-plperl13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-plperl16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-plperl15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-plperl18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:10postgresql-plpython316.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-plpython315.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-plpython316.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-plpython312.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-plpython315.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-plpython313.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-plpython318.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-plpython316.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-pltcl16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-pltcl15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-pltcl12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-pltcl16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-pltcl13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-pltcl16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-pltcl15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-pltcl18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:10postgresql-private-devel16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-private-devel15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-private-devel16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-private-devel15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-private-devel18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-private-devel13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-private-devel16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-private-libs16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-private-libs16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-private-libs15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-private-libs15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-private-libs13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-private-libs18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-private-libs16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-server16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-server15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-server16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-server12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-server15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-server18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-server16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-server13.23-6.el9_8ALSA-2026:69607
AlmaLinux:10postgresql-server-devel16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-server-devel16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-server-devel12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-server-devel15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-server-devel18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-server-devel16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-server-devel15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-server-devel13.23-6.el9_8ALSA-2026:69607
AlmaLinux:10postgresql-static16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-static12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-static15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-static16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-static15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-static18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-static13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-static16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-test16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-test12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-test15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-test16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-test18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-test16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-test13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-test15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:10postgresql-test-rpm-macros16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-test-rpm-macros16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-test-rpm-macros15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-test-rpm-macros12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-test-rpm-macros13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-test-rpm-macros16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-test-rpm-macros15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-test-rpm-macros18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:10postgresql-upgrade16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-upgrade12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-upgrade16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-upgrade15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-upgrade15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-upgrade13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-upgrade18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-upgrade16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-upgrade-devel16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-upgrade-devel16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-upgrade-devel15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-upgrade-devel12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-upgrade-devel16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-upgrade-devel13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-upgrade-devel15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-upgrade-devel18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:10postgresql1818.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-contrib18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-docs18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-plperl18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-plpython318.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-private-devel18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-private-libs18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-server18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-server-devel18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-static18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-test18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-test-rpm-macros18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-upgrade18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-upgrade-devel18.6-1.el10_2ALSA-2026:67280
Alpine:v3.21postgresql1515.19-r0ALPINE-CVE-2026-6471
Alpine:v3.22postgresql1515.19-r0ALPINE-CVE-2026-6471
Alpine:v3.21postgresql1616.15-r0ALPINE-CVE-2026-6471
Alpine:v3.22postgresql1616.15-r0ALPINE-CVE-2026-6471
Alpine:v3.23postgresql1616.15-r0ALPINE-CVE-2026-6471
Alpine:v3.24postgresql1616.15-r0ALPINE-CVE-2026-6471
Alpine:v3.21postgresql1717.11-r0ALPINE-CVE-2026-6471
Alpine:v3.22postgresql1717.11-r0ALPINE-CVE-2026-6471
Alpine:v3.23postgresql1717.11-r0ALPINE-CVE-2026-6471
Alpine:v3.24postgresql1717.11-r0ALPINE-CVE-2026-6471
Alpine:v3.23postgresql1818.5-r0ALPINE-CVE-2026-6471
Alpine:v3.24postgresql1818.5-r0ALPINE-CVE-2026-6471
Debian:12postgresql-1515.19-0+deb12u1DEBIAN-CVE-2026-6471
Debian:13postgresql-1717.11-0+deb13u1DEBIAN-CVE-2026-6471
Debian:14postgresql-1818.6-1DEBIAN-CVE-2026-6471
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1603+444d1b54RLSA-2026:69924
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+1900+d7340343RLSA-2026:69876
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+40057+c37a0e3dRLSA-2026:69876
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+40056+df351139RLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.9.0+1525+fc91df60RLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1622+bd25b19cRLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1858+fcc46a79RLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+1862+29bef648RLSA-2026:69924
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+40055+b85d5ce2RLSA-2026:69924
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1594+4a6adae9RLSA-2026:69924
Rocky Linux:9pg_repack0:1.5.3-1.module+el9.8.0+40158+490b3c67RLSA-2026:67848
Rocky Linux:9pg_repack0:1.4.8-2.module+el9.7.0+40011+28af63c9RLSA-2026:69914
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.8.0+40212+d6f50005RLSA-2026:67491
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.8.0+40159+adcaa225RLSA-2026:67491
Rocky Linux:9pg_repack0:1.5.3-1.module+el9.8.0+40213+f1e225a4RLSA-2026:67848
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1858+fcc46a79RLSA-2026:69876
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1622+bd25b19cRLSA-2026:69876
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.10.0+40056+df351139RLSA-2026:69923
Rocky Linux:8pgaudit0:1.4.0-7.module+el8.9.0+1735+a332307bRLSA-2026:69924
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.9.0+1525+fc91df60RLSA-2026:69923

Affected products (as reported)

VendorProductVersions
n/a PostgreSQL 18 – before 18.617 – before 17.1116 – before 16.1515 – before 15.190 – before 14.24

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References