The pglogical queue system in the EnterpriseDB PostgreSQL extension executes message payloads on the subscriber at the privilege level of the apply worker, which in default installations grants superuser rights. A malicious publisher that can send crafted queue messages can therefore trigger arbitrary SQL to run as a superuser on the subscriber. This allows an attacker who holds permissions to create or manage pglogical subscriptions to gain full superuser privileges and break isolation between tenants in shared deployments. The weakness is a classic SQL injection leading to code execution at the highest privilege level.

EnterpriseDB pglogical is the impacted module. No specific version information is supplied by the CNA, so organizations should consult the referenced advisory to verify the applicability to their installation.

The CVSS score of 9 signifies a critical impact, yet the EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Because by default only superusers can create subscriptions, the primary attack vector is in managed deployments where non‑superuser roles have been granted that ability. An attacker would need to control a publisher endpoint that can direct messages to the target subscriber.