Live › vulnerability › CVE-2026-104948
Go to dashboardBuilt-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version() skip privilege checks, so any authenticated database role can call them. A low-privileged user can block all DDL, GRANT and CREATE ROLE for every user, superusers included, and repeatedly disconnect sessions holding temporary tables.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Clusters running WarehousePG 6.27.1 through 6.27.6 or 7.2.1 through 7.6.0 where any login role exists that a team does not fully trust. The exposure comes from the database role, so multi-tenant or shared-analyst clusters are the highest risk. Single-user clusters where only administrators hold login roles are lower risk.
No product ranges from the sources yet.
SELECT version(); on the WarehousePG cluster and compare against the affected ranges 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0SELECT has_function_privilege('public', 'gp_expand_lock_catalog()', 'EXECUTE');gp_expand_bump_version()REVOKE EXECUTE ON FUNCTION gp_expand_lock_catalog() FROM PUBLIC; and the same for gp_expand_bump_version()Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.
This page as .md · .json · in your agent: get_signal("CVE-2026-104948")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.