CVE-2026-50736
A flaw in PostgreSQL’s pglogical extension lets a publisher send crafted messages that run arbitrary SQL on a subscriber with superuser rights. This breaks tenant isolation in shared deployments and can give an attacker full control of the database.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
PostgreSQL installations using the pglogical extension, especially managed services where non‑superuser roles can create subscriptions.
Real-world impact
An attacker who can control a subscription endpoint can execute any SQL as a superuser on the subscriber, effectively taking over the database and compromising all data stored there.
Why this severity
The CVSS score of 9 reflects the combination of high impact—confidentiality, integrity, availability, and privilege escalation—alongside the difficulty of exploitation, which requires the attacker to control a subscription endpoint but is otherwise straightforward once that condition is met.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources