Executive brief
pglogical is a popular extension for PostgreSQL used to replicate data between different database servers. A security vulnerability allows an attacker who can control a data source to execute malicious code on the receiving database with full administrative (superuser) privileges. This could lead to a complete takeover of the database server, including the ability to view, modify, or delete all customer data.
Technical details
A privilege escalation vulnerability exists in pglogical when applying replicated changes for rows missing one or more columns. The subscriber's apply worker evaluates the table's default expressions at a privilege level equivalent to a PostgreSQL superuser. An attacker acting as a publisher can craft a replication stream that triggers these default expressions, executing arbitrary functions with superuser privileges. This attack requires the ability to direct a subscription to an attacker-controlled endpoint, a configuration typically restricted to superusers but often delegated in managed database environments. The issue is fixed in pglogical version 2.4.8.
Affected products
- EnterpriseDB pglogical 2.x before 2.4.8
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory