12-Year-Old PostgreSQL Flaw Lets Backup Accounts Execute Code and Take Over Databases

A critical PostgreSQL vulnerability dubbed PostGREShell could allow low-privileged backup and replication accounts to execute arbitrary code , escalate to database superuser privileges, and establish persistent access on vulnerable servers. Tracked as CVE-2026-6471, the flaw was discovered by Cyera Research and affects PostgreSQL versions dating back to 9.4, released in 2014. PostgreSQL addressed the issue in its August 22, 2026 security release, ending a vulnerability window…