CVE-2026-50737: pglogical Privilege Escalation Vulnerability

CVE-2026-50737 Overview

CVE-2026-50737 is a privilege escalation vulnerability in the pglogical PostgreSQL replication extension. When applying replicated changes for a row missing one or more columns, pglogical evaluates the target table's default expressions on the subscriber. The apply worker runs at superuser-equivalent privilege in default installations, so any function invoked through a default expression executes as superuser. An attacker acting as a publisher can direct arbitrary functions to run on the subscriber, escalating a role permitted to use pglogical into a full PostgreSQL superuser. This flaw is classified under CWE-250: Execution with Unnecessary Privileges.

Critical Impact
An attacker controlling a publisher endpoint can achieve full PostgreSQL superuser access on the subscriber, compromising confidentiality, integrity, and availability of the database.

Affected Products

pglogical PostgreSQL replication extension
EnterpriseDB (EDB) PostgreSQL deployments using pglogical
Managed PostgreSQL deployments delegating subscription creation to non-superuser roles

Discovery Timeline

2026-07-28 - CVE-2026-50737 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-50737

Vulnerability Analysis

The vulnerability resides in the pglogical apply worker's handling of incomplete row data during replication. When a replicated change arrives without values for every column, pglogical fills in the missing columns by evaluating the target table's DEFAULT expressions on the subscriber. Default expressions in PostgreSQL can call arbitrary functions, including user-defined functions, procedural code, and built-in operations.

Because the apply worker executes with privileges equivalent to a PostgreSQL superuser, any function it evaluates inherits that authority. A publisher acting maliciously can craft replication messages that omit specific columns, causing the subscriber to invoke functions of the attacker's choosing under superuser context. This provides a second, independent escalation path alongside CVE-2026-50736, which covers the related pglogical queue issue.

Root Cause

The root cause is the combination of two design choices. First, the apply worker runs with unnecessary privileges rather than dropping to the role that owns the subscription or the target table. Second, default expressions are evaluated inside that privileged context without sandboxing or privilege reduction. This pattern matches CWE-250, where a process performs operations at higher privilege than the operation requires.

Attack Vector

Exploitation requires the attacker to direct a subscription at a publisher endpoint they control. In default PostgreSQL installations, creating subscriptions requires superuser privileges, limiting exposure. The issue is most relevant to managed PostgreSQL services where subscription creation has been delegated to non-superuser roles. Once a subscription targets the attacker-controlled publisher, the attacker sends replicated row changes with missing columns, and the subscriber evaluates malicious default expressions as superuser. See the EnterpriseDB Security Advisory for vendor technical details.

Detection Methods for CVE-2026-50737

Indicators of Compromise

Unexpected creation of subscriptions pointing to external or untrusted publisher endpoints.
Modifications to table DEFAULT expressions on subscriber databases that introduce function calls to pg_read_server_files, COPY, or shell-invoking extensions.
New superuser roles or role grants appearing shortly after pglogical apply activity in PostgreSQL logs.

Detection Strategies

Audit all pglogical subscriptions and verify that publisher endpoints resolve to trusted infrastructure only.
Review pg_catalog.pg_attrdef for recently modified column defaults on tables participating in replication.
Correlate PostgreSQL audit logs with role privilege changes occurring during apply worker execution windows.

Monitoring Recommendations

Enable pgaudit or equivalent statement-level logging for the apply worker's database role.
Alert on ALTER TABLE ... ALTER COLUMN ... SET DEFAULT statements executed on subscriber nodes.
Monitor for role escalations, CREATE FUNCTION with SECURITY DEFINER, and new extensions installed on subscriber databases.

How to Mitigate CVE-2026-50737

Immediate Actions Required

Inventory all PostgreSQL instances running pglogical and identify which non-superuser roles hold subscription creation privileges.
Revoke subscription creation from any non-superuser role that does not strictly require it.
Restrict outbound network connectivity from PostgreSQL subscribers to a known set of trusted publisher hosts.

Patch Information

Apply the fixed pglogical release referenced in the EnterpriseDB Security Advisory. The advisory covers both CVE-2026-50737 and the related queue issue tracked as CVE-2026-50736, so both should be remediated together.

Workarounds

Remove function calls from DEFAULT expressions on tables that participate in pglogical replication.
Confine subscription management to superuser roles until the patched version is deployed.
Segment subscriber PostgreSQL instances on isolated networks that cannot reach untrusted publisher endpoints.

bash

# Identify non-superuser roles that can create subscriptions and revoke where unnecessary
psql -c "SELECT rolname FROM pg_roles WHERE rolcreaterole OR rolcreatedb;"
psql -c "REVOKE pg_create_subscription FROM <role_name>;"

# Review default expressions on replicated tables
psql -c "SELECT c.relname, a.attname, pg_get_expr(d.adbin, d.adrelid) AS default_expr
         FROM pg_attrdef d
         JOIN pg_attribute a ON a.attrelid = d.adrelid AND a.attnum = d.adnum
         JOIN pg_class c ON c.oid = d.adrelid;"