CVE-2026-50736

CVE-2026-50736 involves pglogical's queue mechanism, which allows arbitrary SQL to be executed on subscriber nodes through queue messages. The apply worker runs at superuser privilege because pglogical needs to convey DDL from publisher to subscriber, and PostgreSQL's privilege model offers no granular way to delegate DDL execution without full superuser access. This was a rational design choice for dedicated replication topologies but becomes a privilege escalation vector when subscription creation is delegated to non-superusers—which managed database services must do to operate at scale. What makes this critical in managed environments: the apply worker with superuser access operates inside a connected system of backup infrastructure, monitoring agents, cross-region replication for disaster recovery, and shared control planes. A malicious queue message can pivot from arbitrary SQL on one subscriber into a cascade affecting every subscriber sharing that infrastructure. The privilege escalation isn't the blast radius—it's the detonator for tenant isolation breach, backup system compromise, and cross-tenant replication path exploitation. Check the following immediately: (1) Identify which roles can create pglogical subscriptions in your environment—this is the delegation point that converts a standard user into a potential superuser escalator. (2) Audit your replication topology map to determine whether pglogical apply workers have connectivity to backup systems, monitoring endpoints, or cross-region replication paths—these are the cascade vectors. (3) Verify whether your managed service provider has compensating controls between 'can create subscription' and 'should be trusted as superuser,' and confirm those controls are actively enforced rather than merely documented. (4) Review any third-party extensions or tools that interact with pglogical replication paths for additional escalation surfaces. The patch restricts queue message execution, addressing the symptom. But the underlying issue—PostgreSQL's inability to express 'replication operator without trust escalation'—will recur in other extensions. Until PostgreSQL introduces intermediate privilege tiers for replication operations, treat every extension that creates subscriptions as a potential superuser escalation vector and map its blast radius accordingly.

Reviewed through automated stages and approved by a human before publication.