CVE-2026-104948

Deferred Deferred - Pending Action

Missing Authorization in WarehousePG Cluster Functions

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: EnterpriseDB Corporation

Description

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-104948

EUVD

EUVD-2026-107263

Affected Vendors & Products

Vendor	Product	Version / Range
EnterpriseDB	WarehousePG	6.27.1
EnterpriseDB	WarehousePG	7.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a missing authorization vulnerability in WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0. It affects two built-in cluster expansion functions, gp_expand_lock_catalog() and gp_expand_bump_version(), which do not verify user privileges. Any authenticated database role can exploit these functions.

Detection Guidance

Check for unauthorized use of gp_expand_lock_catalog() or gp_expand_bump_version() functions by reviewing database logs for these function calls. Look for open transactions held by low-privileged users that block catalog changes. Monitor for repeated disconnections of sessions holding temporary tables.

Impact Analysis

A low-privileged user can block all catalog changes across the cluster by calling gp_expand_lock_catalog() in an open transaction, affecting all users including superusers until the transaction ends. This blocks DDL operations, temporary table creation, GRANT commands, and CREATE ROLE. Repeated calls to gp_expand_bump_version() disconnect sessions with temporary tables and force others to rebuild segment connections.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized users to block critical database operations, potentially disrupting access controls, data integrity, and audit logging. Blocked DDL operations and role changes may prevent proper data governance and access management required by these regulations.

Mitigation Strategies

Immediately revoke public execute permissions on gp_expand_lock_catalog() and gp_expand_bump_version() functions in all databases. This is a temporary measure until upgrading to WarehousePG 6.27.7+ or 7.6.1+. Superusers should terminate any suspicious open transactions blocking catalog changes.

Hi! I’m here to help you understand CVE-2026-104948. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...