PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released updates to address a critical security vulnerability, CVE-2026-6471, that existed for 12 years. The flaw allows a user with replication privileges to execute arbitrary code on the database server by loading a malicious library. The fix introduces a new parameter, output_plugin_libraries, which acts as a whitelist for allowed logical decoding plugins.