CVE-2026-104947
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT, bypassing the superuser restriction PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force segment backends of any other session, including superuser sessions, to write memory context details to segment server logs, which may include query text from other users' cached plans.
Risk Assessment
A low-privileged user can cause sensitive information disclosure in logs and generate large amounts of log output, affecting confidentiality and availability.
Recommendation
Update WarehousePG to a fixed version and restrict privileges on the gp_log_backend_memory_contexts() function.
Other vulnerabilities in WarehousePG
See all- CVE-2026-104949Low
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() (named gp_add_master_standby() in WHPG 6, kept as an alias in WHPG 7). Unlike other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can add a fake standby coordinator entry to gp_segment_configuration on a cluster with no standby configured, preventing administrators from adding a real standby until a superuser removes the fake entry. User data is not exposed or modified.
- CVE-2026-104948High
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 have a missing authorization vulnerability (CWE-862) in the cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them without privilege checks, allowing catalog changes to be blocked cluster-wide or sessions with temporary tables to be repeatedly disconnected.
- CVE-2026-96538High
WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink, and pg_logdir_ls. These functions are executable by any authenticated database role with no GRANT required, because the REVOKE applied in contrib/adminpack was never carried over to WHPG core. A non-superuser can create, overwrite, rename, and delete files under the data and log directories, and can enumerate log file names. They can also append configuration directives to postgresql.auto.conf, resulting in arbitrary code execution as the postgres OS user on the next server restart or configuration reload.
Original NVD description (English source)
WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Those details can include query text from other users' cached plans, and the call can be repeated to generate large amounts of log output. WarehousePG 6.x is not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS