12-Year-Old PostgreSQL Flaw Allows Full Database, Server Takeover

A newly disclosed vulnerability (CVE-2026-6471) in PostgreSQL, dubbed PostGREShell, allows attackers with low-level replication access to escalate to code execution, gain permanent superuser privileges, and install a persistent backdoor. The flaw has existed for 12 years, indicating a long-standing risk across many deployments. Exploitation requires specific access, but the potential for full server compromise makes this a critical concern for organizations relying on PostgreSQL.