CyberRota Analysis
AI-GeneratedPostgreSQL's logical decoding feature is vulnerable due to missing authorization, allowing non-superusers with REPLICATION privileges to execute arbitrary code by loading any file accessible to the server's operating system account. This could lead to significant security breaches, as attackers can exploit this flaw to gain unauthorized access and control over the database environment. Organizations using affected PostgreSQL versions should prioritize patching to mitigate potential risks.
Original NVD Description
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.