CVE-2026-50737

CVE-2026-50737 is the second independent privilege escalation path discovered in pglogical's apply worker, and finding two paths changes how you should think about this vulnerability. Both CVEs share the same root cause: the apply worker runs at PostgreSQL superuser privilege by default, and when it processes data from an untrusted publisher, that data can trigger superuser-level function execution on the subscriber. The first path was through default expressions; this second path is a separate code path with the same underlying weakness. The critical realization is that this is not two independent bugs — it is evidence of a systemic architectural flaw. The apply worker does not need to be superuser to replicate rows; it needs elevated privileges for specific operations that were never enumerated or restricted. The superuser default exists because it was convenient, not because it was necessary, and that convenience created a permanent attack surface. If you have delegated pglogical subscription creation to non-superuser roles — common in managed PostgreSQL deployments — you are now exposed through a vector you likely didn't model. The assumption that subscription privileges were a bounded blast radius is invalid. Any role that can create a subscription against an untrusted or compromised publisher now represents a privilege escalation path to superuser on the subscriber. For immediate action: audit who can create pglogical subscriptions in your environment. Treat any subscription targeting a publisher you do not fully control as a potential compromise vector. There is no patch that fixes the underlying design problem — only patches for the specific paths researchers have found. Assume additional paths exist until pglogical explicitly documents the minimum privilege set required for the apply worker, or implements explicit privilege reduction in code. For managed service customers: ask your provider what privileges the apply worker executes with and whether subscription creation has been restricted to trusted publisher endpoints. If they cannot answer definitively, treat the subscription interface as a privileged operation requiring the same access controls as database superuser functions.

Reviewed through automated stages and approved by a human before publication.