First Published: 2026/10/30
Last Updated: 2026/10/30
Summary
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.
Vulnerability details
CVE-ID: CVE-2026-104948
CVSS Base Score: 7.1 High
CVSS Temporal Score: Undefined
CVSS Environmental Score: Undefined
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products and versions
- Affected Product: WarehousePG
- Affected Versions: WarehousePG 6.27.1 through 6.27.6, and WarehousePG 7.2.1 through 7.6.0
Remediation/fixes
Impacted users must upgrade to a fixed version of WarehousePG.
| Product | VRMF | Remediation/First Fix |
|---|---|---|
| WarehousePG | 6.27.1 through 6.27.6 | Update to WarehousePG 6.27.7 or later |
| WarehousePG | 7.2.1 through 7.6.0 | Update to WarehousePG 7.6.1 or later |
Immediate mitigation for existing clusters
Until you can upgrade, apply the following as a superuser in every connectable database (all user databases, postgres, and template1, so that new databases inherit the change). The statements apply to both WarehousePG 6 and 7:
REVOKE EXECUTE ON FUNCTION gp_expand_lock_catalog() FROM public; REVOKE EXECUTE ON FUNCTION gp_expand_bump_version() FROM public;
The gpexpand utility runs as a superuser and is not affected by this change. This is a stopgap, not a replacement for upgrading: it must be applied in every database and does not protect databases created afterward unless it was also run against template1.
References
- CVSS Calculator v4.0
- CWE-862 Missing Authorization
- warehouse-pg/warehouse-pg#323 (WarehousePG 7)
- warehouse-pg/warehouse-pg#327 (WarehousePG 6)
Related information
Acknowledgement
Source: Discovered internally by EDB while triaging a related report.
Change history
- 2026/10/30: Original Copy Published
Disclaimer
This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. EDB reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document.