CVE-2026-50736

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50736", "assignerOrgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "state": "PUBLISHED", "assignerShortName": "EDB", "dateReserved": "2026-06-05T19:13:51.103Z", "datePublished": "2026-07-28T17:55:27.283Z", "dateUpdated": "2026-07-28T18:54:34.942Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "shortName": "EDB", "dateUpdated": "2026-07-28T17:55:27.283Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "affected": [{"vendor": "EnterpriseDB", "product": "pglogical", "versions": [{"version": "2", "status": "affected", "lessThan": "2.4.8", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Mehmet Ince (@mdisec)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "references": [{"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650736/"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T18:54:11.406226Z", "id": "CVE-2026-50736", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T18:54:34.942Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T18:54:11.406226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T18:54:17.479Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Mehmet Ince (@mdisec)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "EnterpriseDB", "product": "pglogical", "versions": [{"status": "affected", "version": "2", "lessThan": "2.4.8", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.enterprisedb.com/docs/security/advisories/cve202650736/"}], "descriptions": [{"lang": "en", "value": "The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "shortName": "EDB", "dateUpdated": "2026-07-28T17:55:27.283Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50736", "state": "PUBLISHED", "dateUpdated": "2026-07-28T18:54:34.942Z", "dateReserved": "2026-06-05T19:13:51.103Z", "assignerOrgId": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "datePublished": "2026-07-28T17:55:27.283Z", "assignerShortName": "EDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "pglogical", "vendor": "EnterpriseDB", "versions": [{"lessThan": "2.4.8", "status": "affected", "version": "2", "versionType": "semver"}]}], "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*", "matchCriteriaId": "DC0E75E2-2571-4AB8-892A-DA7B88B722EF", "versionEndExcluding": "2.4.8", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."}, {"lang": "es", "value": "El mecanismo de cola de pglogical, utilizado para transmitir comandos fuera de banda como DDL replicado de un publicador a un suscriptor, ejecuta las cargas \u00fatiles de los mensajes en el suscriptor con el nivel de privilegio del trabajador de aplicaci\u00f3n, que es equivalente a un superusuario de PostgreSQL en instalaciones predeterminadas. Una parte que act\u00faa como publicador puede enviar mensajes de cola manipulados que provocan la ejecuci\u00f3n de SQL arbitrario en el suscriptor como superusuario, escalando de un rol permitido para usar pglogical a superusuario completo y rompiendo el aislamiento entre inquilinos en despliegues compartidos. Para explotar el problema, un atacante debe poder dirigir una suscripci\u00f3n a un punto final que controlan. En instalaciones predeterminadas, esto requiere privilegios normalmente reservados para un superusuario, por lo que el problema es m\u00e1s relevante para despliegues gestionados donde la capacidad de crear suscripciones ha sido delegada a roles que no son superusuarios."}], "id": "CVE-2026-50736", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50736", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-28T18:54:11.406226Z", "version": "2.0.3"}}]}, "published": "2026-07-28T19:17:36.700", "references": [{"source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "tags": ["Vendor Advisory"], "url": "https://www.enterprisedb.com/docs/security/advisories/cve202650736/"}], "sourceIdentifier": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2,2.4.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "pglogical", "source": "cna", "vendor": "EnterpriseDB"}, "product": "pglogical", "vendor": "enterprisedb"}], "created": "2026-07-28T20:33:55.293552+00:00", "updated": "2026-08-04T13:00:11.582008+00:00", "vendors": ["enterprisedb", "enterprisedb$PRODUCT$pglogical"]}