CVE-2026-50737 Privilege escalation in pglogical
A malicious publisher can execute arbitrary functions as superuser on a pglogical subscriber by exploiting default expression evaluation during row replication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50737?
CVE-2026-50737 is a critical vulnerability in EnterpriseDB pglogical, published on 28 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser.
This is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
Weakness: CWE-250
Which versions are affected by CVE-2026-50737?
It affects 1 product.
Products include Enterprisedb Pglogical.
How do I fix CVE-2026-50737?
Apply the vendor's patch.
Is CVE-2026-50737 being exploited?
There is no known exploitation of CVE-2026-50737 in the wild and no public exploit code.
Other vulnerabilities in EnterpriseDB pglogical
Sources
Also known as DEBIAN-CVE-2026-50737, ECHO-2055-6c03-d4b2, GHSA-h7hw-g87c-29wh, UBUNTU-CVE-2026-50737.