PatchTheCVECVE-2026-50736: The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to
35
Routine
HIGH 7.5UPGRADE
CVE-2026-50736 is a high-severity flaw (CVSS 7.5) affecting pglogical. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitt
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 65%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2026-07-28 |
| Last modified | 2026-10-23 |
Publisher (CNA): EnterpriseDB Corporation · Vendor: enterprisedb
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
enterprisedb pglogical UPGRADE
Affected: >= 2.0.0 and < 2.4.8
Fixed in: 2.4.8
Safe to downgrade to: a release before 2.0.0
1. Check installed version
apt-cache policy pglogical || rpm -q pglogical || pglogical --version
2. UPGRADE to 2.4.8 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade pglogical
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade pglogical
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.0.0 (Debian / Ubuntu)
apt-cache madison pglogical
sudo apt install pglogical=<VERSION_BEFORE_2.0.0>
sudo apt-mark hold pglogical
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list pglogical
sudo dnf downgrade pglogical-<VERSION_BEFORE_2.0.0>
sudo dnf versionlock add pglogical
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-50737 HIGH 7.5 UPGRADE When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affect
- CVE-2026-50735 MEDIUM 6.8 UPGRADE pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication p
- CVE-2026-50738 MEDIUM 5.3 UPGRADE A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be derefe