1 article on this topic.
A missing authorization check in PostgreSQL's logical decoding, present since 2014, let any account with the REPLICATION attribute run arbitrary code as the database's OS user. Patches shipped August 13, 2026.