PostgreSQL Logical Decoding Arbitrary Library Loading via REPLICATION Privilege (PostGREShell)

#!/usr/bin/env bash
# check_cve_2026_6471.sh - Detect CVE-2026-6471 (PostGREShell) exposure
# Run on PostgreSQL host. Outputs: VULNERABLE / PATCHED / UNKNOWN
set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'

# Attempt to get PostgreSQL version
if command -v psql &>/dev/null; then
  PG_VERSION=$(psql -t -A -c "SELECT version();" 2>/dev/null || echo "")
  PG_SERVER_NUM=$(psql -t -A -c "SHOW server_version_num;" 2>/dev/null || echo "")
  WAL_LEVEL=$(psql -t -A -c "SHOW wal_level;" 2>/dev/null || echo "unknown")
  REPL_ROLES=$(psql -t -A -c "SELECT count(*) FROM pg_roles WHERE rolreplication = true;" 2>/dev/null || echo "unknown")
elif command -v pg_config &>/dev/null; then
  PG_VERSION=$(pg_config --version 2>/dev/null || echo "")
  PG_SERVER_NUM=""
  WAL_LEVEL="unknown"
  REPL_ROLES="unknown"
else
  echo -e "${YELLOW}UNKNOWN${NC} - psql and pg_config not found on this host."
  exit 2
fi

if [ -z "$PG_SERVER_NUM" ]; then
  echo -e "${YELLOW}UNKNOWN${NC} - Could not determine PostgreSQL server version."
  echo "Detected: $PG_VERSION"
  exit 2
fi

SERVER_NUM=$((10#$PG_SERVER_NUM))

# Fixed version numbers (server_version_num format: XXYYZZ)
# 14.24=140024, 15.19=150019, 16.15=160015, 17.11=170011, 18.6=180006
VULNERABLE=0
if   [ $SERVER_NUM -ge 180000 ] && [ $SERVER_NUM -lt 180006 ]; then VULNERABLE=1
elif [ $SERVER_NUM -ge 170000 ] && [ $SERVER_NUM -lt 170011 ]; then VULNERABLE=1
elif [ $SERVER_NUM -ge 160000 ] && [ $SERVER_NUM -lt 160015 ]; then VULNERABLE=1
elif [ $SERVER_NUM -ge 150000 ] && [ $SERVER_NUM -lt 150019 ]; then VULNERABLE=1
elif [ $SERVER_NUM -ge 140000 ] && [ $SERVER_NUM -lt 140024 ]; then VULNERABLE=1
elif [ $SERVER_NUM -lt 140000 ] && [ $SERVER_NUM -ge 90400 ]; then
  # PostgreSQL 9.4 through 13.x - all vulnerable, no fix for EOL branches
  VULNERABLE=1
fi

echo "PostgreSQL server_version_num: $PG_SERVER_NUM"
echo "wal_level: $WAL_LEVEL"
echo "Roles with REPLICATION: $REPL_ROLES"
echo ""

if [ $VULNERABLE -eq 1 ]; then
  echo -e "${RED}VULNERABLE${NC} - CVE-2026-6471 (PostGREShell)"
  if [ "$WAL_LEVEL" = "logical" ]; then
    echo -e "  ${RED}EXPLOITABLE${NC} - wal_level=logical is set. Immediate risk."
  else
    echo "  wal_level=$WAL_LEVEL (not 'logical') - reduced but not eliminated risk."
  fi
  if [ "$REPL_ROLES" != "unknown" ] && [ "$REPL_ROLES" -gt 0 ]; then
    echo "  $REPL_ROLES role(s) with REPLICATION attribute found."
  fi
  echo "  Fix: upgrade to 14.24 / 15.19 / 16.15 / 17.11 / 18.6+"
  exit 1
else
  echo -e "${GREEN}PATCHED${NC} - PostgreSQL version is not affected by CVE-2026-6471."
  exit 0
fi