PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released security updates to address CVE-2026-6471, a high-severity vulnerability present since version 9.4 in 2014 that permits users with the REPLICATION attribute to execute arbitrary code as the database server's operating system user. The flaw arises because the logical decoding mechanism allows malicious specification of output plugin libraries, bypassing standard load restrictions. Affected versions include those prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24; administrators must apply these updates and configure the new output_plugin_libraries parameter to whitelist permitted plugins, particularly if using third-party tools like wal2json.