CVE-2026-50736: pglogical Privilege Escalation Vulnerability

CVE-2026-50736 Overview

CVE-2026-50736 is a SQL injection and privilege escalation flaw in the pglogical PostgreSQL replication extension. The pglogical queue mechanism transports out-of-band commands, such as replicated DDL, from a publisher to a subscriber. The subscriber's apply worker executes those message payloads with its own privileges, which equal PostgreSQL superuser in default installations. A party controlling the publisher can craft queue messages that run arbitrary SQL on the subscriber as superuser. The flaw breaks tenant isolation in shared deployments where the ability to create subscriptions has been delegated to non-superuser roles.

Critical Impact
An attacker who controls a publisher endpoint targeted by a subscription can execute arbitrary SQL as PostgreSQL superuser on the subscriber, escalating from a pglogical-permitted role to full database compromise.

Affected Products

EnterpriseDB pglogical replication extension for PostgreSQL
Managed PostgreSQL deployments where subscription creation is delegated to non-superuser roles
Multi-tenant PostgreSQL environments using pglogical for logical replication

Discovery Timeline

2026-07-28 - CVE-2026-50736 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-50736

Vulnerability Analysis

The pglogical extension provides logical replication for PostgreSQL by streaming changes from a publisher node to one or more subscriber nodes. Alongside row-level changes, pglogical uses an in-band queue to convey out-of-band commands, most notably replicated DDL statements. Subscribers process this queue through an apply worker background process. That worker holds elevated database privileges, and in default installations those privileges are equivalent to a PostgreSQL superuser. The vulnerability, categorized as SQL injection under CWE-89, arises because the subscriber executes the payloads it receives from the publisher without adequate constraint on their contents.

Root Cause

The subscriber trusts the publisher-supplied queue payload and dispatches it into the SQL execution path at the apply worker's privilege level. There is no privilege downgrade before executing the received command, and no restriction that limits queue messages to a safe subset of DDL. Any SQL a publisher chooses to inject into the queue runs on the subscriber as superuser.

Attack Vector

Exploitation requires an attacker to direct a subscription at an endpoint they control. In default installations, creating subscriptions is restricted to superusers, so the risk is limited. The condition is materially different in managed PostgreSQL services where operators delegate subscription creation to lower-privileged tenant roles. A tenant with permission to use pglogical can stand up an attacker-controlled publisher, cause the target subscriber to connect to it, and emit crafted queue messages containing arbitrary SQL. The subscriber's apply worker then executes that SQL as superuser, allowing the attacker to read or modify any data, alter roles, disable auditing, or pivot into other tenants sharing the instance.

The vulnerability mechanism is described in the EnterpriseDB Security Advisory. No public proof-of-concept is currently available.

Detection Methods for CVE-2026-50736

Indicators of Compromise

Unexpected CREATE SUBSCRIPTION or pglogical.create_subscription calls issued by non-administrative roles.
Subscriptions whose connection strings point to hosts outside the organization's approved replication topology.
Apply worker executions of DDL or role-management SQL that were not originated by an administrator, visible in PostgreSQL logs.
New superuser roles, altered role memberships, or unexpected extensions installed shortly after a subscription is established.

Detection Strategies

Enable log_statement = 'ddl' or log_statement = 'all' on subscriber nodes and alert on DDL executed by the pglogical apply worker outside change windows.
Audit pglogical.subscription and pg_subscription catalogs for subscriptions whose publisher host is not in an allowlist.
Correlate PostgreSQL role changes and extension installations with the identity that created the associated subscription.

Monitoring Recommendations

Forward PostgreSQL server logs and pglogical worker logs to a centralized analytics platform for retention and correlation.
Track privileged catalog changes (pg_authid, pg_roles, pg_extension) and alert on writes outside of approved maintenance activity.
Monitor outbound network connections from database hosts to unexpected replication endpoints.

How to Mitigate CVE-2026-50736

Immediate Actions Required

Review who holds the privileges required to create pglogical subscriptions and revoke that capability from any role that does not strictly require it.
Inventory existing subscriptions and confirm each publisher endpoint is operated by a trusted party.
Consult the EnterpriseDB Security Advisory and apply the fixed pglogical release for your PostgreSQL version.
In managed multi-tenant deployments, treat any tenant role previously granted subscription-creation rights as potentially able to have compromised the shared instance and investigate accordingly.

Patch Information

EnterpriseDB has published guidance and fixed builds for pglogical in the EnterpriseDB Security Advisory. Operators should upgrade all subscriber nodes to a patched pglogical version and restart the apply workers so the fixed code path handles queue messages.

Workarounds

Restrict subscription creation to PostgreSQL superusers and remove any custom grants that delegate this ability to tenants.
Constrain outbound network egress from database servers so subscribers can only reach approved publisher hosts.
Where feasible, run pglogical subscribers on dedicated instances rather than shared multi-tenant clusters until patched.

bash

# Configuration example: revoke delegated subscription privileges and audit existing subscriptions
REVOKE pglogical_superuser FROM tenant_role;
SELECT sub_name, sub_origin, sub_target, sub_enabled FROM pglogical.subscription;
SELECT subname, subconninfo, subenabled FROM pg_subscription;