CVE-2026-50737: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-50737 is a privilege escalation vulnerability in EnterpriseDB's pglogical extension for PostgreSQL that allows a party acting as a publisher to cause arbitrary functions to be executed on the subscriber with PostgreSQL superuser privileges. The flaw arises when pglogical applies replicated changes for rows missing one or more columns and evaluates the affected table's default expressions under the apply worker's superuser-equivalent context. It affects pglogical versions 2.x before 2.4.8 and was published on July 28, 2026. It carries a CVSS v4.0 base score of 9.0 (Critical) (GitHub Advisory). This is a second, independent privilege escalation path related to CVE-2026-50736 (the pglogical queue issue) (GitHub Advisory).

The root cause is classified as CWE-250 (Execution with Unnecessary Privileges): pglogical's apply worker runs at a privilege level equivalent to a PostgreSQL superuser, and when it evaluates default column expressions for rows missing those columns during replication, any function embedded in those defaults inherits that superuser context. An attacker who controls a publisher endpoint can craft a replication stream that sends rows intentionally missing columns, triggering evaluation of malicious default expressions on the subscriber. Exploitation requires the attacker to direct a pglogical subscription at an endpoint they control, which in default PostgreSQL installations requires superuser privileges — but in managed cloud deployments where subscription creation has been delegated to non-superuser roles, this becomes exploitable by lower-privileged users (GitHub Advisory).

Successful exploitation grants the attacker full PostgreSQL superuser access on the subscriber database, enabling complete confidentiality, integrity, and availability compromise of the database system. An attacker can read, modify, or delete any data, create new superuser accounts, execute operating system commands (via functions like COPY TO/FROM PROGRAM or pg_read_file), and potentially pivot to the underlying host. Both the vulnerable system and subsequent systems (e.g., connected databases or services) are assessed as having high impact across all three CIA dimensions (GitHub Advisory).

1. Identify target: Locate a managed PostgreSQL deployment running pglogical < 2.4.8 where subscription creation has been delegated to a non-superuser role, or obtain a low-privileged role with pglogical subscription creation rights.
2. Set up malicious publisher: Deploy a controlled PostgreSQL instance with pglogical configured as a publisher. Create a table with a column whose DEFAULT expression calls a privileged function (e.g., DEFAULT pg_read_file('/etc/passwd') or a function that creates a superuser account).
3. Create subscription on target: Using the delegated non-superuser role on the subscriber, create a pglogical subscription pointing to the attacker-controlled publisher endpoint.
4. Trigger missing-column replication: Publish a row to the subscriber that is missing the column with the malicious default expression, causing pglogical's apply worker to evaluate the default expression on the subscriber.
5. Achieve superuser execution: The apply worker evaluates the malicious default function at superuser privilege level, executing the attacker's chosen function — such as creating a new superuser account or exfiltrating sensitive data — on the subscriber database (GitHub Advisory).

• Logs: PostgreSQL server logs showing unexpected function executions (e.g., pg_read_file, COPY ... FROM PROGRAM, or custom functions) originating from the pglogical apply worker process; log entries for new role creation or privilege grants by the apply worker.
• Network: Outbound pglogical replication connections from the subscriber to unexpected or external publisher endpoints on port 5432 (or configured PostgreSQL port); new or unrecognized replication slots on the subscriber.
• Database: Unexpected new superuser roles or roles with elevated privileges created in pg_roles; unfamiliar pglogical subscriptions visible in pglogical.subscription; unusual entries in pg_stat_replication or pg_stat_activity showing apply worker activity.
• Process: Unexpected child processes spawned by the PostgreSQL backend (e.g., shell commands, file access utilities) if OS-level functions were invoked via the default expression exploit path.

Update pglogical to version 2.4.8 or later, which contains the fix for this vulnerability (GitHub Advisory, EDB Advisory). As a workaround in managed deployments, restrict the ability to create pglogical subscriptions exclusively to trusted superuser roles and revoke subscription creation privileges from non-superuser roles. Additionally, implement network-level controls (e.g., firewall rules, pg_hba.conf restrictions) to limit which endpoints pglogical subscribers are permitted to connect to, preventing redirection to attacker-controlled publishers.