pglogical vulnerabilities

2 known vulnerabilities in pglogical from EnterpriseDB. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  pglogical: Execution with Unnecessary Privileges

  CVE-2026-50737Jul 28, 2026EnterpriseDB

  When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default i

• 7.5 High severity

  pglogical: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-50736Jul 28, 2026EnterpriseDB

  The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in