CVE-2026-120145 PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

Red Hat rates this vulnerability as Important because an attacker controlling an upstream publisher can achieve arbitrary remote code execution under the postgres operating system user account on the subscriber host. In default Red Hat Enterprise Linux installations, PostgreSQL does not establish logical replication subscriptions out of the box, significantly limiting ambient exposure. The security risk is restricted to specific environments where an administrator has configured a superuser-owned subscription that pulls changes from an untrusted or compromised external database instance.

Disable logical replication subscriptions connected to untrusted publisher databases, or reassign subscription ownership to an unprivileged database role.

1. Disable an untrusted subscription directly from the PostgreSQL prompt:

ALTER SUBSCRIPTION <subscription_name> DISABLE;

2. Alternatively, transfer the subscription ownership away from a superuser:

ALTER SUBSCRIPTION <subscription_name> OWNER TO <non_superuser_role>;

3. Restrict outgoing network connections to unverified publisher hosts at the network or firewall level.

Caveats: Disabling subscriptions halts data synchronization between publisher and subscriber tables until manually re-enabled. Non-superuser roles must have adequate table privileges to apply replicated data.

Warning: Modifying subscriptions or applying firewall changes interrupts active replication sessions but does not require a PostgreSQL service restart.