PostgreSQL <18.7 logical replication auth bypass OS RCE
CVE-2026-120145 Published on November 12, 2026
PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code
Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Vulnerability Analysis
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-120145 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-120145
Want to know whenever a new CVE is published for PostgreSQL? stack.watch will email you.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.