[{"data":1,"prerenderedAt":179},["ShallowReactive",2],{"seo-verification":3,"blog-postgresql-cve-2026-6471-patch-self-hosted-instances-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-postgresql-cve-2026-6471-patch-self-hosted-instances-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"category":21,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":119,"ctaBody":120,"ctaButton":121,"ctaUrl":122,"relatedPosts":123},339,"postgresql-cve-2026-6471-patch-self-hosted-instances",{"fr":12,"en":10,"ar":13,"es":14},"postgresql-cve-2026-6471-patch-instances-self-hosted","تصحيح-ثغرة-postgresql-cve-2026-6471-الخوادم-الذاتية","cve-2026-6471-postgresql-parchear-instancias-self-hosted","Patching PostgreSQL (CVE-2026-6471, -14669) on VPS","Two critical PostgreSQL flaws fixed on August 13, 2026: replication access to RCE and heap overflow to RCE. How to patch your self-hosted instances via apt and Docker.",7,1,false,"2026-09-08T00:00:00+00:00",{"id":22,"name":23,"slug":24,"color":25,"icon":26},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[28],{"id":22,"name":23,"slug":24,"color":25,"icon":26},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fpostgresql-cve-2026-6471-patch-instances-self-hosted-poster.svg","On August 13, 2026, the PostgreSQL team published fixes for 28 vulnerabilities, including two that allow an attacker to execute arbitrary code with the privileges of the database process. CVE-2026-6471 exploits logical decoding to load an arbitrary library — a vector that has been present since PostgreSQL 9.4. CVE-2026-14669 is a buffer overflow in `to_char()` that can be triggered by any authenticated user. If you self-host PostgreSQL — inside a Supabase, NocoDB, Gitea, Twenty, or any other application instance — here is how to assess your exposure and apply the patch.",[34,38,70,73,76,95,107,110,113,116],{"type":35,"title":36,"body":37},"h2","What these two vulnerabilities do","CVE-2026-6471 (CVSS 7.2) affects the logical decoding mechanism introduced in PostgreSQL 9.4. An account holding the REPLICATION attribute can specify an arbitrary output plugin when creating a logical replication slot. Before the fix, PostgreSQL loaded the requested file via `dlopen` without verifying its origin, allowing code to be executed with the privileges of the `postgres` system account. The attacker does not need direct network access to your instance: a compromised replication peer, a CDC (Change Data Capture) tool, or an internal user with the REPLICATION attribute is enough. The fix adds an `output_plugin_libraries` parameter listing allowed libraries — defaulting to `pgoutput` and `test_decoding` only.\n\nCVE-2026-14669 (CVSS 8.8) is a heap buffer overflow in the `to_char(timestamptz)` function. The function builds a work buffer from the format string, but the POSIX timezone handling code paths copy the user-supplied abbreviation into that buffer without a length check. An ordinary authenticated user can trigger the vulnerability by passing an excessively long timezone abbreviation, overwriting adjacent heap structures and hijacking execution to achieve arbitrary code execution with `postgres` OS user privileges.",{"type":39,"title":40,"headers":41,"rows":45},"comparison","Two CVE comparison",[42,43,44],"Criterion","CVE-2026-6471","CVE-2026-14669",[46,50,54,57,61,64,67],[47,48,49],"CVSS Score","7.2 (High)","8.8 (High)",[51,52,53],"Component","Logical decoding","`to_char(timestamptz)`",[55,56,56],"Attack vector","Network",[58,59,60],"Minimum required privilege","REPLICATION attribute","Authenticated user",[62,63,63],"Public access required","No",[65,66,66],"Impact type","Arbitrary code execution",[68,69,69],"Fix date","2026-08-13",{"type":35,"title":71,"body":72},"Affected and fixed versions","Both CVEs affect all maintained PostgreSQL branches. The fixed versions, released simultaneously on August 13, 2026, are: PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24. Any instance running a version older than these numbers is exposed. PostgreSQL 13 and earlier have reached end of life and no longer receive patches: if your instance runs on an end-of-life branch, these CVEs add to an already existing structural risk. Applications that embed PostgreSQL — Supabase, NocoDB, Gitea, Twenty CRM, Planka — are affected if they have not yet updated their base image.",{"type":35,"title":74,"body":75},"Before patching: audit your replication roles","Before applying the patch, it is worth knowing how many accounts carry the REPLICATION attribute on your instances. The following query lists all concerned roles:\n\n`SELECT rolname, rolreplication, rolsuper FROM pg_roles WHERE rolreplication = true OR rolsuper = true ORDER BY rolsuper DESC, rolname;`\n\nIf you find accounts with REPLICATION that are not serving an active replication purpose (backup, CDC, monitoring), revoke the attribute: `ALTER ROLE role_name NOREPLICATION;`. This is a partial workaround while waiting for the patch, and a permanent good practice.",{"type":77,"title":78,"steps":79},"steps","Patching via apt on Debian and Ubuntu",[80,83,86,89,92],{"title":81,"body":82},"Check the current version","Connect to your instance and check the current version: `psql -U postgres -c 'SELECT version();'`. Note the branch (14, 15, 16, 17, or 18) to install the correct target package.",{"title":84,"body":85},"Ensure the PGDG repository is configured","Standard Debian and Ubuntu repositories often ship outdated versions. To get up-to-date fixes, use the official PostgreSQL repository. If not already configured: `sudo apt install -y postgresql-common && sudo \u002Fusr\u002Fshare\u002Fpostgresql-common\u002Fpgdg\u002Fapt.postgresql.org.sh`. This script configures the PGDG repository for your distribution.",{"title":87,"body":88},"Update the packages","A minor update (17.10 → 17.11, 16.14 → 16.15, etc.) does not require `pg_upgradecluster` and keeps your data in place. Run: `sudo apt update && sudo apt install postgresql-17` (replace `17` with your branch). APT will install the fixed version. For other branches: `sudo apt install postgresql-16`, `postgresql-15`, `postgresql-14` as appropriate.",{"title":90,"body":91},"Restart the service","The service must be restarted to load the new binary: `sudo systemctl restart postgresql`. Then verify the service restarted correctly: `sudo systemctl status postgresql`.",{"title":93,"body":94},"Confirm the version after patching","Reconnect and verify the displayed version matches the fix: `psql -U postgres -c 'SELECT version();'`. You should see 17.11, 16.15, 15.19, 14.24, or 18.6 depending on your branch.",{"type":77,"title":96,"steps":97},"Patching via Docker",[98,101,104],{"title":99,"body":100},"Pull the fixed image","The official `postgres` images on Docker Hub have been updated with the fixed versions. Pull the image matching your branch: `docker pull postgres:17.11`, or with the minor tag for your branch (`postgres:16.15`, `postgres:15.19`, `postgres:14.24`). For Alpine images: `docker pull postgres:17.11-alpine`.",{"title":102,"body":103},"Restart the container","If you use Docker Compose, update the image tag in your `docker-compose.yml`, then: `docker compose pull && docker compose up -d`. For a directly launched container: `docker stop postgres-container && docker rm postgres-container`, then relaunch with the new image. Your data stays in the mounted volume — verify the volume is declared before removing the container.",{"title":105,"body":106},"Verify the version inside the container","Connect to the container and confirm the version: `docker exec -it postgres-container psql -U postgres -c 'SELECT version();'`. The output should show the fixed version.",{"type":35,"title":108,"body":109},"Workarounds if patching is temporarily impossible","If you cannot restart the instance immediately, three measures reduce exposure to CVE-2026-6471 without applying the patch:\n\nFirst, revoke the REPLICATION attribute from accounts that do not need it (`ALTER ROLE name NOREPLICATION;`). Second, restrict replication entries in `pg_hba.conf` to the IP addresses of legitimate peers only — replace a rule `host replication all 0.0.0.0\u002F0` with entries specific to each authorized host. Third, if your instance does not use logical replication at all, you can set `wal_level = replica` (instead of `logical`) in `postgresql.conf` — this disables logical decoding and closes the CVE-2026-6471 attack vector.\n\nFor CVE-2026-14669, no application-level workaround is documented: the only remedy is updating the binary.",{"type":35,"title":111,"body":112},"Checking applications that embed PostgreSQL","Supabase, NocoDB, Gitea, Twenty CRM, and Planka embed PostgreSQL in their Docker images or Helm charts. For these applications, updating PostgreSQL means updating the application image itself. Check each application's release notes: since August 13, 2026, distributions that published an update should have integrated PostgreSQL 17.11, 16.15, or equivalent. If no update is available for your application, you can deploy a separate PostgreSQL container at the fixed version and point the application to it — or pin the postgres base image in your `docker-compose.yml` to the fixed version, if the architecture allows.",{"type":114,"body":115},"tip","The `SELECT version();` command in psql is not sufficient to confirm the fix is active if multiple PostgreSQL binaries coexist on the same host. Check which binary is actually running: `pg_lsclusters` on Debian\u002FUbuntu lists all clusters with their version. Ensure the active cluster is using the updated binary, not a residual binary from a previous installation.",{"type":35,"title":117,"body":118},"Deploy PostgreSQL with root access to apply patches yourself","On shared hosting or in a PaaS environment, you have no access to the PostgreSQL binary: the update depends on your provider. On a VPS with root access, you apply this patch in under ten minutes, without depending on a third party. You choose the restart window, you keep control over `pg_hba.conf`, and you audit your replication roles yourself. This is the model that naturally applies to any self-hosted stack.","Deploy PostgreSQL on a Root-Access VPS","A ServOrbit Cloud VPS gives you full root access to apply this patch in under ten minutes, configure `pg_hba.conf`, and audit your replication roles without depending on a third party.","Configure My PostgreSQL VPS Solution","\u002Fvps-cloud",[124,148,165],{"id":125,"slug":126,"slugs":127,"title":131,"excerpt":132,"readTime":133,"views":134,"isPinned":19,"publishedAt":135,"category":136,"categories":142,"featuredImage":29,"bgImage":30,"posterImage":144,"relatedSolution":145},56,"postgresql-on-a-vps-a-reliable-and-controlled-database",{"fr":128,"en":126,"ar":129,"es":130},"heberger-postgresql-vps","postgresql-على-خادم-vps-قاعدة-بيانات-موثوقة-ومتحكم-بها","alojar-postgresql-en-un-vps","PostgreSQL on a VPS: a reliable and controlled database","Host PostgreSQL on a VPS: volumes, backups, restricted network access and sound configuration for your applications.",4,0,"2026-04-25T00:00:00+00:00",{"id":137,"name":138,"slug":139,"color":140,"icon":141},6,"Databases","bases-de-donnees","bg-teal-500\u002F10 text-teal-400","database",[143],{"id":137,"name":138,"slug":139,"color":140,"icon":141},"\u002Fblog\u002Fcovers\u002Fheberger-postgresql-vps-poster.svg",{"categorySlug":146,"appSlug":147},"databases","postgresql-stack",{"id":149,"slug":150,"slugs":151,"title":155,"excerpt":156,"readTime":157,"views":134,"isPinned":19,"publishedAt":158,"category":159,"categories":160,"featuredImage":29,"bgImage":30,"posterImage":162,"relatedSolution":163},60,"hosting-supabase-on-a-vps",{"fr":152,"en":150,"ar":153,"es":154},"heberger-supabase-vps","استضافة-supabase-على-خادم-vps","alojar-supabase-en-un-vps","Hosting Supabase on a VPS in 2026","Self-host Supabase on your Cloud VPS: Postgres, Auth, Storage, and REST API with Envoy Gateway. Kong→Envoy migration guide, S3 URL troubleshooting.",11,"2026-04-21T00:00:00+00:00",{"id":137,"name":138,"slug":139,"color":140,"icon":141},[161],{"id":137,"name":138,"slug":139,"color":140,"icon":141},"\u002Fblog\u002Fcovers\u002Fheberger-supabase-vps-poster.svg",{"categorySlug":146,"appSlug":164},"supabase",{"id":166,"slug":167,"slugs":168,"title":172,"excerpt":173,"readTime":133,"views":134,"isPinned":19,"publishedAt":174,"category":175,"categories":176,"featuredImage":29,"bgImage":30,"posterImage":178,"relatedSolution":29},225,"postgresql-end-of-life-plan-your-major-upgrade",{"fr":169,"en":167,"ar":170,"es":171},"postgresql-fin-de-vie-planifier-montee-version","postgresql-ونهاية-الدعم-تخطيط-الترقية-الكبرى","postgresql-fin-de-vida-planificar-actualizacion","PostgreSQL end of life: plan your major upgrade","PostgreSQL supports each major version for five years, ending in November. Find out which one you run and plan the upgrade without losing data.","2026-08-05T00:00:00+00:00",{"id":137,"name":138,"slug":139,"color":140,"icon":141},[177],{"id":137,"name":138,"slug":139,"color":140,"icon":141},"\u002Fblog\u002Fcovers\u002Fpostgresql-fin-de-vie-planifier-montee-version-poster.svg",1789046177149]