{"id":"CVE-2026-104948","kind":"vulnerability","aliases":["CVE-2026-104948"],"related":[],"title":"WarehousePG: any login role can freeze catalog changes cluster-wide","description":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.","summary":"Built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version() skip privilege checks, so any authenticated database role can call them. A low-privileged user can block all DDL, GRANT and CREATE ROLE for every user, superusers included, and repeatedly disconnect sessions holding temporary tables.","severity":"high","cvss":7.1,"epss":0.00216,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-warehouse","greenplum","package","postgres","self-hosted","warehousepg"],"not_affected_if":["single-role-cluster","versions-outside-range"],"how_to_check":"- Run `SELECT version();` on the WarehousePG cluster and compare against the affected ranges 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0\n- Check whether any non-superuser role can execute the functions: `SELECT has_function_privilege('public', 'gp_expand_lock_catalog()', 'EXECUTE');`\n- Repeat the same check for `gp_expand_bump_version()`","fix":"- Upgrade WarehousePG to a release newer than 6.27.6 (6.27 line) or newer than 7.6.0 (7.x line); the sources do not name the exact fixed version, so check the vendor release notes\n- Until patched, revoke execute from non-admin roles: `REVOKE EXECUTE ON FUNCTION gp_expand_lock_catalog() FROM PUBLIC;` and the same for `gp_expand_bump_version()`","status":"open","published_at":"2026-10-21T14:17:09+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:53+00:00","updated_at":"2026-10-25T03:31:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:31:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WarehousePG to a release newer than 6.27.6 (6.27 line) or newer than 7.6.0 (7.x line); the sources do not name the exact fixed version, so check the vendor release notes\n- Until patched, revoke execute from non-admin roles: `REVOKE EXECUTE ON FUNCTION gp_expand_lock_catalog() FROM PUBLIC;` and the same for `gp_expand_bump_version()`","reach":"network","title":"WarehousePG: any login role can freeze catalog changes cluster-wide","impact":"medium","summary":"Built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version() skip privilege checks, so any authenticated database role can call them. A low-privileged user can block all DDL, GRANT and CREATE ROLE for every user, superusers included, and repeatedly disconnect sessions holding temporary tables.","category":"package","nicknames":[],"who_cares":["warehousepg","greenplum","postgres","data-warehouse","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privileged user blocks all catalog changes and disconnects sessions cluster-wide","analyst_note":"Sources do not name the fixed release; check the WarehousePG vendor advisory or release notes for the patched version numbers.","how_to_check":"- Run `SELECT version();` on the WarehousePG cluster and compare against the affected ranges 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0\n- Check whether any non-superuser role can execute the functions: `SELECT has_function_privilege('public', 'gp_expand_lock_catalog()', 'EXECUTE');`\n- Repeat the same check for `gp_expand_bump_version()`","needs_analyst":true,"not_affected_if":["single-role-cluster","versions-outside-range"],"who_is_affected":"Clusters running WarehousePG 6.27.1 through 6.27.6 or 7.2.1 through 7.6.0 where any login role exists that a team does not fully trust. The exposure comes from the database role, so multi-tenant or shared-analyst clusters are the highest risk. Single-user clusters where only administrators hold login roles are lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":3578,"output_tokens":825,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104948':14A,17A '-2026':13A,16A '-862':96C '6.27.1':81C '6.27.6':83C '7.2.1':85C '7.6.0':87C 'across':145C 'affect':89C 'authent':48B,115C 'author':93C 'block':60B,141C,167C 'built':29B,100C 'built-in':28B,99C 'bump':41B,112C,185C 'call':52B,131C,182C,189C 'catalog':7A,37B,108C,135C,143C,203C 'chang':8A,144C,168C,204C 'check':45B,123C 'cluster':10A,31B,102C,147C 'cluster-wid':9A 'connect':213C 'creat':65B,176C 'creation':173C 'cve':12A,15A 'cwe':95C 'data':19B 'data-warehous':18B 'databas':49B,116C 'ddl':62B,170C 'disconnect':74B,190C 'end':156C 'error':199C 'everi':68B,149C,207C 'expand':35B,40B,106C,111C,133C,184C 'expans':32B,103C 'fatal':198C 'freez':6A 'function':33B,104C 'gp':34B,39B,105C,110C,132C,183C 'grant':63B,174C 'greenplum':21B 'hold':76B,193C 'host':26B 'includ':71B,152C,169C 'insid':136C 'lock':36B,107C,134C 'login':3A 'low':56B,127C 'low-privileg':55B,126C 'make':206C 'miss':92C 'neither':122C 'next':202C 'open':138C 'packag':22B 'postgr':23B 'practic':159C 'privileg':44B,57B,124C,128C 'rebuild':210C 'repeat':73B,187C 'requir':160C 'role':4A,50B,66B,117C,177C 'run':119C 'segment':212C 'self':25B 'self-host':24B 'session':75B,166C,191C,209C 'skip':43B 'superus':70B,151C,162C 'tabl':78B,172C,195C 'temporari':77B,171C,194C 'termin':164C 'transact':139C,155C 'user':58B,69B,129C,150C,180C 'version':42B,113C,186C 'vulner':94C 'warehous':20B 'warehousepg':1A,27B,79C 'whpg':80C 'wide':11A","nicknames":[],"mitigations":[],"who_affected":"Clusters running WarehousePG 6.27.1 through 6.27.6 or 7.2.1 through 7.6.0 where any login role exists that a team does not fully trust. The exposure comes from the database role, so multi-tenant or shared-analyst clusters are the highest risk. Single-user clusters where only administrators hold login roles are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104948","severity":null,"published_at":"2026-10-21T14:17:09+00:00","modified_at":"2026-10-22T16:58:51+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-104948","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104948","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}