PostgreSQL Server Executes Code via Malicious Logical Decoding Plugin

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.