CVE-2026-50737

What it is

When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser. This is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-28 19:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-23 23:10 UTC Last updatedMost recent change to the record

Details

Published

2026-07-28 19:17 UTC

Last modified

2026-10-23 23:10 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-250 · Unnecessary privileges

Record status

Analyzed

Affected

• Enterprisedb Pglogical < 2.4.8

Attack profile CVSS 4.0 · 9.0

Attack vector

Network

Complexity

High

Attack requirements

Present

Privileges needed

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High