The pglogical queue mechanism in EnterpriseDB's pglogical extension executes out-of-band commands such as replicated DDL on the subscriber at the privilege level of the apply worker, equivalent to a PostgreSQL superuser by default. This design flaw allows a publisher to send specially crafted queue messages that result in arbitrary SQL execution on the subscriber with superuser privileges. This effectively escalates privileges from a role allowed to use pglogical to full superuser, compromising tenant isolation in multi-tenant or shared deployments. Successful exploitation requires control over the subscription endpoint, which typically demands superuser privileges in default setups, limiting the vulnerability's impact to managed deployments where subscription creation is delegated to less privileged roles.

An attacker with the ability to act as a publisher can execute arbitrary SQL commands on the subscriber database with superuser privileges. This leads to full privilege escalation and breaks tenant isolation in shared or multi-tenant environments. The vulnerability could allow unauthorized data access, modification, or disruption of the subscriber database. However, exploitation requires the attacker to control the subscription endpoint, which normally requires superuser privileges, limiting the risk to managed deployments with delegated subscription creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability to create subscriptions to trusted superuser roles only. Avoid delegating subscription creation privileges to non-superuser roles in managed deployments. Monitor vendor communications for updates on patches or official mitigations.