PostgreSQL Patches 12-Year-Old Logical Decoding RCE

The logical decoding feature in PostgreSQL is used heavily in change data capture pipelines, streaming replication setups, and database migration tooling. It has been in the codebase since PostgreSQL 9.4, released in December 2014. A security flaw introduced alongside it, affecting accounts that hold the REPLICATION attribute, has now been patched in a coordinated update across all actively supported major versions.

The flaw allows a PostgreSQL account with REPLICATION privileges to execute arbitrary code as the operating-system user running the database server, typically the postgres system user. That is a meaningful jump from the database layer to the OS layer: a compromised service account used for logical replication, or an internal actor with the right database role, could run code on the underlying host.

REPLICATION is not a privilege most deployments grant casually. It is required for streaming replication slots and for logical decoding consumers such as Debezium and similar CDC tools. Organizations that run those pipelines typically have service accounts holding this privilege, often with less scrutiny applied than they give to superuser accounts. That gap in attention is the exposure window that mattered here.

Twelve years is a long time for a flaw to sit in a feature’s code, but it is not unusual in this part of the stack. Logical decoding’s attack surface was not obvious when the feature shipped, and the execution path requires a privilege that the documentation does not flag as dangerous in this context. A privilege that sounds administrative but opens an OS-level path: that is exactly where bugs like this age quietly.

The PostgreSQL Global Development Group has released patches across all supported major versions. Administrators running PostgreSQL in environments where REPLICATION is granted to any account should update and audit which roles carry that attribute. Full advisory details, including affected versions and patch links, are on the PostgreSQL security page.

Database-layer-to-OS escalation paths have surfaced elsewhere this quarter. A CVSS 9.9 flaw in StackGres let a database tenant reach cluster-admin level, and JFrog Artifactory’s unauthenticated-to-admin path was actively exploited before most shops had patched. The shared thread is that infrastructure tooling tends to get fewer eyeballs on its privilege model than the applications sitting on top of it.