CVE-2026-50738

CVE-2026-50738 is a use-after-free in pglogical's worker signaling code that can crash replication workers. The CVSS 7.7 and 'worst case RCE' framing in the official description requires scrutiny from operators running pglogical in production. The key distinction is between what this bug can do in theory versus practice. A low-privileged user with 'permitted pglogical operations' access can influence worker timing and trigger the UAF — but pglogical operational access implies a service account already trusted with replication topology management. This isn't an unauthenticated SQL injection; it's a reliability regression for users who already have database-level operational access. The privilege escalation claim deserves skepticism unless the attacker can escalate from the pglogical operational role to postgres backend privileges without already having them. The availability impact is the realistic concern. Worker crashes don't just restart — they can desynchronize replication slots and WAL positions. In high-availability stacks (exactly where pglogical is deployed), triggering this at the wrong moment during slot validation handoff or long-running transaction replay could produce silent data divergence worse than a crash. Your monitoring may not catch a replica that has drifted. The EPSS score of 0.00301 reflects near-zero active exploitation, which aligns with the attack prerequisites: operational access to a replication setup, timing precision, and a specialized target. This isn't a priority patch for most environments, but it should prompt questions: What is the crash condition reproducibility — tight timing windows or reliably triggerable? Does your HA topology have manual intervention procedures if a replica desyncs? If pglogical is in maintenance mode in your environment, consider migration paths to native PostgreSQL logical replication, which eliminates this extension-specific attack surface entirely.

Reviewed through automated stages and approved by a human before publication.