CVE-2026-50737 in pglogical
Summary
by MITRE • 07/28/2026
When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser.
This is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability represents a critical privilege escalation flaw in pglogical, a PostgreSQL extension used for logical replication and data synchronization across database instances. The security issue arises from how pglogical handles replicated changes when rows are missing one or more columns during the replication process. When such scenarios occur, the system evaluates default expressions defined on the subscriber's table schema, creating an execution path that can be exploited by malicious actors. This represents a fundamental design weakness in the privilege separation mechanisms of the logical replication system, where the apply worker operates with superuser privileges by default, creating a dangerous attack surface.
The technical flaw stems from the improper handling of default expressions during row replication operations, specifically when column data is missing from replicated changes. When pglogical processes these incomplete rows on the subscriber side, it executes default expression functions with elevated privileges equivalent to PostgreSQL superuser access. This creates an arbitrary code execution vector where malicious actors can inject and execute arbitrary functions with full database administrative privileges. The vulnerability operates under CWE-264, which addresses permissions, privileges, and access controls, specifically focusing on the principle of least privilege violation. This flaw aligns with ATT&CK technique T1068, which involves exploiting legitimate credentials to gain system-level privileges through the manipulation of system components.
The operational impact of this vulnerability is severe for organizations using pglogical in managed environments where subscription creation privileges have been delegated to non-superuser roles. An attacker who can control a subscription endpoint and manipulate replication data can escalate their privileges from a role permitted to use pglogical to full superuser access, effectively compromising the entire database system. This escalation path allows for complete database compromise including data exfiltration, privilege manipulation, and potential lateral movement within the network infrastructure. The vulnerability is particularly dangerous in cloud environments or managed service deployments where administrative delegation occurs frequently.
Mitigation strategies must address both the immediate privilege escalation risk and the underlying architectural issues. Organizations should implement strict access controls to prevent non-superuser roles from creating subscriptions to arbitrary endpoints, ensuring that subscription management remains restricted to trusted superuser accounts. Additionally, default expression functions on replicated tables should be carefully audited and restricted to minimal necessary privileges, with consideration for using more restrictive security contexts. The pglogical extension itself requires updates to implement proper privilege separation during default expression evaluation, ensuring that these functions execute with reduced privileges rather than full superuser access. Organizations should also monitor replication activities for unusual subscription patterns and implement network segmentation to limit potential attack vectors. This vulnerability demonstrates the critical importance of privilege separation in distributed database systems and highlights the need for comprehensive security reviews of logical replication mechanisms.