CVE-2026-50736 SQL injection in pglogical
A malicious publisher can execute arbitrary SQL as superuser on a subscriber via crafted queue messages, requiring delegated subscription creation privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50736?
CVE-2026-50736 is a critical SQL injection vulnerability in EnterpriseDB pglogical, published on 28 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Weakness: CWE-89
Which versions are affected by CVE-2026-50736?
It affects 1 product.
Products include Enterprisedb Pglogical.
How do I fix CVE-2026-50736?
Apply the vendor's patch.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-50736 being exploited?
There is no known exploitation of CVE-2026-50736 in the wild and no public exploit code.
Other vulnerabilities in EnterpriseDB pglogical
Sources
Also known as DEBIAN-CVE-2026-50736, ECHO-f126-0745-5489, GHSA-cg29-63x4-27px, UBUNTU-CVE-2026-50736.