Live › vulnerability › CVE-2026-104947
Go to dashboardWarehousePG 7.2.1 through 7.6.0 exposes gp_log_backend_memory_contexts() without an authorization check, so any authenticated database role can call it. The call makes other sessions, including superuser ones, write memory context details to segment server logs, which can contain other users' cached query text and can be repeated to flood the logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of WarehousePG 7.2.1 through 7.6.0 where any database role that can log in can reach the function. WarehousePG 6.x is not affected according to the description. Clusters where every login role is trusted and the function is already restricted have less exposure.
No product ranges from the sources yet.
gpstate --version or postgres --version and check whether it falls in 7.2.1 through 7.6.0\df+ gp_log_backend_memory_contexts in psqlREVOKE EXECUTE ON FUNCTION gp_log_backend_memory_contexts(integer) FROM PUBLIC; (signature unknown from sources; verify with \df)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Those details can include query text from other users' cached plans, and the call can be repeated to generate large amounts of log output. WarehousePG 6.x is not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-104947")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.