This vulnerability arises because pglogical's apply worker runs with superuser privileges by default. When applying replicated changes for rows missing columns, default expressions are evaluated on the subscriber with these elevated privileges. If a malicious publisher directs changes invoking functions within these defaults, those functions execute as superuser on the subscriber. This creates a privilege escalation path from a role permitted to use pglogical to full superuser. Exploitation requires control over the subscription endpoint, which generally requires superuser privileges, limiting the risk primarily to managed deployments with delegated subscription creation.

An attacker with the ability to act as the publisher and direct a subscription to an endpoint they control can escalate privileges on the subscriber to superuser. This can lead to full control over the subscriber database instance. The vulnerability is critical due to the high privileges involved and the potential for complete system compromise. However, exploitation requires specific conditions, including the ability to create or redirect subscriptions, which is typically restricted to superusers in default setups.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the ability to create or modify subscriptions to trusted superuser roles only. Avoid delegating subscription creation privileges to non-superuser roles in managed environments. Monitor vendor advisories for updates regarding official patches or mitigations.