Blog · 24 October 2026
Is your PostgreSQL up to date? Your backup account is the way in
On 13 August 2026 the PostgreSQL project fixed CVE-2026-6471. It scores 7.2 out of 10. It did not make headlines, yet it touches something almost every database has: a backup account.
What the flaw does
An account holding the REPLICATION privilege can ask the server to load a file of its choice and run it as the operating-system account postgres. In plain words: “replication” access can turn into full control of the server.
The researcher who published it, Cyera, calls it “PostGREShell”. It has been there since 2014 (versions 9.4 to 18).
You hand that privilege out yourself: to your backup tool, your replicas, your monitoring and your data pipelines. Those credentials sit in config files, on backup servers, sometimes in scripts. It is the account nobody worries about.
What it is not
I am not telling you to panic. The attacker needs an account with that privilege first: a stranger on the internet cannot use it without credentials. The 7.2 score reflects that. But a stolen backup secret is a common scenario, and here it is enough to take everything.
Fixed versions
You are safe on at least:
- 18.6
- 17.11
- 16.15
- 15.19
- 14.24
PostgreSQL 13 and earlier are unsupported: no fix exists for them. PostgreSQL 14 gets its last update on 12 November 2026, so 14.24 is one of the last versions to carry this fix.
Check in 5 minutes
First query, the version:
SELECT version();If the number is below your branch above, schedule the minor upgrade. It is a restart, not a migration.
Second query, who holds the privilege:
SELECT rolname, rolsuper FROM pg_roles WHERE rolreplication;For each row, ask: does this tool really need it? A monitoring account usually does not. Remove the privilege where it is not needed:
ALTER ROLE account_name NOREPLICATION;Test first: physical backups and replication use this privilege, so do not remove it from those accounts.
What I do for my clients
I check three things: the exact server version, the list of REPLICATION accounts, and which networks may connect for replication (pg_hba.conf). Then I test a restore, because an upgrade that breaks your backup is something you only find out the day you need it.
That is what Restore Check covers: I restore your backup on a test server, time it, check the content and hand you a report. Fixed price, from EUR 1,490 excl. VAT.
If you are still on PostgreSQL 14, now is also the time to look at migration: EUR 2,900 excl. VAT per instance, fixed price.
Gilles Fauvie, dbfactory
Sources : postgresql.org — CVE-2026-6471 · SecurityWeek — PostGREShell