CVE-2026-104949
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() (named gp_add_master_standby() in WHPG 6, kept as an alias in WHPG 7). Unlike other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can add a fake standby coordinator entry to gp_segment_configuration on a cluster with no standby configured, preventing administrators from adding a real standby until a superuser removes the fake entry. User data is not exposed or modified.
Risk Assessment
A low-privileged user can block the ability to configure a standby coordinator, hindering high availability of the cluster. Exploitation requires a utility-mode connection.
Recommendation
Update WarehousePG to a version containing the fix. Restrict utility-mode connections to trusted users and check gp_segment_configuration for unexpected entries.
Other vulnerabilities in WarehousePG
See all- CVE-2026-104948High
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 have a missing authorization vulnerability (CWE-862) in the cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them without privilege checks, allowing catalog changes to be blocked cluster-wide or sessions with temporary tables to be repeatedly disconnected.
- CVE-2026-104947Medium
WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT, bypassing the superuser restriction PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force segment backends of any other session, including superuser sessions, to write memory context details to segment server logs, which may include query text from other users' cached plans.
- CVE-2026-96538High
WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink, and pg_logdir_ls. These functions are executable by any authenticated database role with no GRANT required, because the REVOKE applied in contrib/adminpack was never carried over to WHPG core. A non-superuser can create, overwrite, rename, and delete files under the data and log directories, and can enumerate log file names. They can also append configuration directives to postgresql.auto.conf, resulting in arbitrary code execution as the postgres OS user on the next server restart or configuration reload.
Original NVD description (English source)
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can use it to add a fake standby coordinator entry to gp_segment_configuration on a cluster that has no standby configured. Administrators then cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS