type: incident · created: 2026-09-05 · updated: 2026-09-05 · tags: [incident, cve, postgresql, database, code-execution, replication] · confidence: high · affected_sectors: [technology, finance, government] · au_impact: true
PostgreSQL Fixes 12-Year-Old Flaw Enabling Code Execution on Replication Role
PostgreSQL has patched a logical decoding flaw first introduced around 12 years ago that lets an attacker with the replication role execute code on the system, tracked as an integer-overflow to memory-corruption bug in the logical decoding path of WAL (write-ahead log) replay. The flaw was disclosed alongside additive updates to multiple supported branches.
| Attribute | Detail |
|---|---|
| Product | PostgreSQL (WAL logical decoding) |
| Age | ~12 years |
| Impact | Code execution via replication role → integer overflow to memory corruption |
| Significance | Replication role is a legitimate, privileged-but-logical database function, often keyed by credentials rather than full OS access |
| Source | The Hacker News — Tier 2/4 |
The replication role is a privileged-but-logical database function keyed by creational credentials; the flaw turns it into system code execution — a high-priority update for PostgreSQL deployments, including Australian/NZ enterprise and government use.