Saint PostGREShell, Who Opened the Database Door

Patron of PostgreSQL databases, logical replication, and doors left ajar for twelve years.

Life

On 1 September 2026 Vladimir Tokarev of Cyera described a flaw in PostgreSQL open since 2014. A non-admin user, as long as they held the replication privilege, could tell the server to load any library as a logical decoding plugin: the server opened it and ran its code as the database account, from which to escalate to superuser. The fixed releases came out in August.

Prayer

O Saint PostGREShell, who picks the plugin and the server runs it, let our loader open only the libraries of the house. Amen.

How to celebrate

Celebrated by upgrading PostgreSQL to 18.6, 17.11, 16.15, 15.19 or 14.24 and taking the replication privilege from those who don't need it.

A door left ajar for years, one day someone pushes it.