PostgreSQL: Logical replication arbitrary code execution (CVE-2026-120145)
PostgreSQL logical replication contains a flaw allowing arbitrary code execution when a superuser-owned subscription targets a system catalog, impacting multiple major versions.
CVE search metadata
CVE search record: CVE-2026-120145. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25). Brief: PostgreSQL: Logical replication arbitrary code execution (CVE-2026-120145). Brief link: https://feed.craftedsignal.io/briefs/2026-11-postgresql-replication-rce-cve-2026-120145/
Triage facts
Revision 1- Applicability
- PostgreSQL (< 18.7, < 17.12, < 16.16, < 15.20, < 14.25)
- Evidence
- Unknown
- Severity
- High
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 12, 16:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
PostgreSQL is vulnerable to arbitrary code execution (CVE-2026-120145) due to missing authorization checks within its logical replication feature. A compromised publisher can execute code as the operating system user running a subscription, provided that the subscription is owned by a database superuser and targets a system catalog. The vulnerability affects all PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.
Impact
Successful exploitation allows an attacker to execute arbitrary code with the privileges of the operating system user running the PostgreSQL service, potentially leading to full system compromise if the service runs with excessive permissions.
Recommendation
- Upgrade PostgreSQL instances to version 18.7, 17.12, 16.16, 15.20, 14.25, or later immediately.
- Audit existing logical replication subscriptions to identify those owned by superusers.
- Ensure that PostgreSQL service accounts follow the principle of least privilege to limit the impact of potential command execution.
Immediate actions
Upgrade all PostgreSQL database instances to the patched versions (18.7, 17.12, 16.16, 15.20, or 14.25).
Threat Hunt
Identify PostgreSQL subscriptions currently owned by superuser accounts that may be targeted for malicious logical replication.
Data: PostgreSQL system catalog data (pg_subscription, pg_roles)
Mitigations
Upgrade PostgreSQL to 18.7 or later
CVE-2026-120145