CVE-2026-50737

{
  "id": "CVE-2026-50737",
  "sourceIdentifier": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
  "published": "2026-07-28T19:17:36.827",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser.\n\nThis is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles."
    },
    {
      "lang": "es",
      "value": "Al aplicar cambios replicados para una fila a la que le faltan una o más columnas, pglogical evalúa las expresiones predeterminadas de la tabla afectada en el suscriptor. Debido a que el trabajador de aplicación se ejecuta con un nivel de privilegio equivalente al de un superusuario de PostgreSQL en instalaciones predeterminadas, cualquier función invocada por dicha expresión predeterminada también se ejecuta con ese privilegio. Una parte que actúa como publicador puede usar esta ruta para hacer que las funciones se ejecuten en el suscriptor como superusuario, escalando de un rol permitido para usar pglogical a superusuario completo.\n\nEsta es una segunda ruta independiente a la misma escalada de superusuario rastreada bajo CVE-2026-50736 (el problema de la cola de pglogical). Para explotar el problema, un atacante debe poder dirigir una suscripción a un punto final que controlan. En instalaciones predeterminadas, esto requiere privilegios normalmente reservados para un superusuario, por lo que el problema es más relevante para implementaciones gestionadas donde la capacidad de crear suscripciones ha sido delegada a roles que no son de superusuario."
    }
  ],
  "affected": [
    {
      "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
      "affectedData": [
        {
          "vendor": "EnterpriseDB",
          "product": "pglogical",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "2",
              "lessThan": "2.4.8",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T18:48:38.115237Z",
          "id": "CVE-2026-50737",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:enterprisedb:pglogical:*:*:*:*:*:postgresql:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.4.8",
              "matchCriteriaId": "DC0E75E2-2571-4AB8-892A-DA7B88B722EF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.enterprisedb.com/docs/security/advisories/cve202650737/",
      "source": "20be33e2-bf35-4d13-8fad-18bd2f3e3659",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}