CVE-2026-50737 When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privi...
- Published
- Updated
- Exploit status
- No public exploit known
Description
When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser.
This is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| EnterpriseDB pglogical | >= 2, < 2.4.8 | 2.4.8 |
| debian/pglogical(Debian:12) | All versions | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.2-3 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.3-1 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.3-2 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.4-1 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.4-2 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.4-3 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.5-1 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.6-1 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.6-2 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.7-1 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.8-1 | No fix listed |
| debian/pglogical(Debian:12) | = 2.4.8-2 | No fix listed |
| debian/pglogical(Debian:13) | All versions | No fix listed |
| debian/pglogical(Debian:13) | = 2.4.5-1 | No fix listed |
| debian/pglogical(Debian:13) | = 2.4.6-1 | No fix listed |
| debian/pglogical(Debian:13) | = 2.4.6-2 | No fix listed |
| debian/pglogical(Debian:13) | = 2.4.7-1 | No fix listed |
| debian/pglogical(Debian:13) | = 2.4.8-1 | No fix listed |
| debian/pglogical(Debian:13) | = 2.4.8-2 | No fix listed |
| debian/pglogical(Debian:14) | < 2.4.8-1 | 2.4.8-1 |
| debian/pglogical(Debian:14) | = 2.4.5-1 | No fix listed |
| debian/pglogical(Debian:14) | = 2.4.6-1 | No fix listed |
| debian/pglogical(Debian:14) | = 2.4.6-2 | No fix listed |
Show 6 more
| debian/pglogical(Debian:14) | = 2.4.7-1 | No fix listed |
| ubuntu/pglogical(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/pglogical(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/pglogical(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/pglogical(Ubuntu:26.10) | All versions | No fix listed |
| EnterpriseDB pglogical | >= 2.0.0, < 2.4.8 | 2.4.8 |
References
- www.enterprisedb.com vendor-advisory
- security-tracker.debian.org vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org