The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher
    to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker,
    which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher
    can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser,
    escalating from a role permitted to use pglogical to full superuser and breaking the isolation between
    tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at
    an endpoint they control. In default installations this requires privileges normally reserved for a
    superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions
    has been delegated to non-superuser roles. (CVE-2026-50736)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher     to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker,     which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher     can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser,     escalating from a role permitted to use pglogical to full superuser and breaking the isolation between     tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at     an endpoint they control. In default installations this requires privileges normally reserved for a     superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions     has been delegated to non-superuser roles. (CVE-2026-50736)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463926	Echo: pglogical: security update to 2.4.8	Tenable Cloud Security	Echo Local Security Checks	Local	critical
463926	Echo: pglogical: security update to 2.4.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
330654	Linux Distros Unpatched Vulnerability : CVE-2026-50736	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-50736

critical

Tenable Plugins

critical

critical

critical