CVE-2026-50737
A flaw in PostgreSQL’s pglogical extension lets a publisher force a subscriber to run arbitrary functions as a superuser when replicating changes for a row that lacks one or more columns. The issue is a privilege‑escalation vulnerability that can give an attacker full control over the subscriber database.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
PostgreSQL installations that use the pglogical extension, especially managed deployments where non‑superuser roles can create subscriptions.
Real-world impact
An attacker who can set up a subscription to a controlled endpoint can cause the subscriber to execute any function with superuser rights, potentially compromising the entire database and all data it holds.
Why this severity
The CVSS score of 9 reflects the high impact of gaining superuser privileges (confidentiality, integrity, and availability are all fully compromised) combined with the need for network access and a relatively high attack complexity. The score also accounts for the fact that the vulnerability is exploitable only when the attacker can create a subscription, which is typically restricted to privileged users.
What to do about it
- ›Restrict the creation of pglogical subscriptions to superuser roles and avoid using default expressions that invoke privileged functions.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources