External risk intelligence

pglogical Subscriber Command Execution Leading to PostgreSQL Superuser Privilege Escalation.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-50736

The vulnerability affects pglogical replication, which operates on backend database ports. These are typically restricted to internal network segments or between authorized database nodes. While network-reachable, direct exposure of database replication interfaces to the public internet is uncommon and contrary to standard secure deployment practices.

SQL Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The pglogical queue mechanism, a component within PostgreSQL, has a critical vulnerability that allows unauthorized execution of arbitrary SQL commands on subscriber systems. This occurs when specially crafted messages are sent through the replication queue, potentially granting superuser privileges and compromising tenant isolation in shared environments. Exploitation requires the ability to direct a subscription to an attacker-controlled endpoint, making it most relevant to managed deployments where non-superusers have been granted subscription creation privileges.

Unauthorized commands can run as superuser.
Elevates privileges in shared database deployments.
Confirm relevance in delegated subscription management.

Attack Path

How an attacker could exploit the issue

An attacker with control over a pglogical subscription endpoint could send specially crafted messages. These messages are processed by the subscriber's queue mechanism, leading to the execution of arbitrary SQL commands with PostgreSQL superuser privileges. This allows the attacker to escalate their privileges and potentially break tenant isolation in shared database environments.

Requires control of a subscription endpoint.
Triggered by sending crafted queue messages.
Results in arbitrary superuser SQL execution.

Live Threat

Current exploitation, exposure, and threat context

The pglogical queue mechanism could allow a publisher to execute arbitrary SQL on a subscriber as a PostgreSQL superuser. This could occur when a party acting as the publisher sends crafted queue messages to a subscriber they control. In default installations, this requires privileges normally reserved for a superuser, making it most relevant to managed deployments where creating subscriptions has been delegated to non-superuser roles.

Arbitrary SQL execution on subscriber.
Crafted queue messages sent to controlled endpoint.
Tenant isolation broken in shared deployments.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the pglogical queue mechanism could allow an attacker to execute arbitrary SQL on a PostgreSQL subscriber with superuser privileges. Technical leaders should first work with their database administrators and platform teams to inventory all PostgreSQL instances using pglogical. Confirming the scope of affected systems and the specific roles with subscription creation privileges is crucial before planning any remediation, especially in multi-tenant environments where isolation can be breached.

Identify PostgreSQL instances using pglogical.
Verify roles with subscription creation privileges.
Plan remediation with database administrators.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is pglogical and how is it used?

pglogical is a PostgreSQL extension designed for logical replication. It allows data to be streamed between independent database instances, making it a common choice for migrating data, creating read replicas, or consolidating data across different systems. It functions by tracking data changes at the table level and queuing them to be applied on a subscriber instance.

How does CVE-2026-50736 lead to unauthorized SQL execution?

This vulnerability involves a weakness in how the pglogical queue processes incoming messages. Specifically, it relates to improper sanitization of commands, classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because the system executes these messages with high-level superuser privileges, a malicious publisher can inject arbitrary SQL commands that the subscriber then runs automatically.

What must happen for this vulnerability to be triggered?

An attacker must be able to direct a pglogical subscription to an endpoint they control. The vulnerability does not trigger through standard data replication between trusted nodes; it requires a malicious actor to act as a publisher and send specifically crafted queue messages to a subscriber. If you do not allow arbitrary or untrusted entities to configure replication endpoints, this path is not available.

Is my database at risk if it is not exposed to the internet?

Halo Surface Signal notes that while this is a critical issue, direct exposure of database replication interfaces to the public internet is uncommon. The risk is significantly higher in managed or shared database environments where non-administrative users have been granted the ability to create and manage their own subscriptions, as this delegation provides the necessary access to point a subscriber at a malicious endpoint.

How should I respond if I use pglogical?

Start by identifying all PostgreSQL instances in your environment that utilize the pglogical extension. Once identified, work with your database administrators to audit which roles have been granted permission to create subscriptions. You should prioritize reviewing environments where subscription management has been delegated to non-superuser accounts, as these are the configurations where this vulnerability is most likely to be weaponized.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.