{"id":"CVE-2026-104949","kind":"vulnerability","aliases":["CVE-2026-104949"],"related":[],"title":"WarehousePG: missing privilege check lets low-privileged users add fake standby","description":"WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can use it to add a fake standby coordinator entry to gp_segment_configuration on a cluster that has no standby configured. Administrators then cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.","summary":"WarehousePG's gp_add_coordinator_standby() function, also named gp_add_master_standby(), does not require superuser rights, so a low-privileged user with a utility-mode connection can insert a fake standby coordinator entry into gp_segment_configuration. The fake entry blocks administrators from adding a real standby until a superuser removes it, and user data is not exposed or modified.","severity":"low","cvss":2.3,"epss":0.00216,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-warehouse","package","postgres","self-hosted","warehousepg"],"not_affected_if":["default-config","superuser-only-access"],"how_to_check":"- Run `SELECT version();` in the WarehousePG database to confirm whether the release is in `6.27.1` through `6.27.6` or `7.2.1` through `7.6.0`.\n- Check whether the cluster has a standby coordinator configured, and look for unexpected standby rows in `gp_segment_configuration`.\n- Review which roles can open utility-mode connections.","fix":"- Upgrade WarehousePG 6 past `6.27.6` or WarehousePG 7 past `7.6.0` to a fixed release (the fixed version is unknown from the sources).\n- Remove any fake standby entry from `gp_segment_configuration` with a superuser account after upgrading.","status":"open","published_at":"2026-10-21T14:17:09+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:49:46+00:00","updated_at":"2026-10-25T04:49:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:49:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WarehousePG 6 past `6.27.6` or WarehousePG 7 past `7.6.0` to a fixed release (the fixed version is unknown from the sources).\n- Remove any fake standby entry from `gp_segment_configuration` with a superuser account after upgrading.","reach":"local","title":"WarehousePG: missing privilege check lets low-privileged users add fake standby","impact":"low","summary":"WarehousePG's gp_add_coordinator_standby() function, also named gp_add_master_standby(), does not require superuser rights, so a low-privileged user with a utility-mode connection can insert a fake standby coordinator entry into gp_segment_configuration. The fake entry blocks administrators from adding a real standby until a superuser removes it, and user data is not exposed or modified.","category":"package","nicknames":[],"who_cares":["warehousepg","postgres","data-warehouse","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"A low-privileged user corrupts standby configuration and blocks real standby setup","analyst_note":"","how_to_check":"- Run `SELECT version();` in the WarehousePG database to confirm whether the release is in `6.27.1` through `6.27.6` or `7.2.1` through `7.6.0`.\n- Check whether the cluster has a standby coordinator configured, and look for unexpected standby rows in `gp_segment_configuration`.\n- Review which roles can open utility-mode connections.","needs_analyst":false,"not_affected_if":["default-config","superuser-only-access"],"who_is_affected":"Clusters running WarehousePG 6.27.1 through 6.27.6 or 7.2.1 through 7.6.0 are exposed, and the risk is that any role able to open a utility-mode connection can call the function. Clusters with no standby configured are the ones where the fake entry takes effect. Teams on other WarehousePG versions or on other Greenplum-derived databases can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00071,"input_tokens":3513,"output_tokens":718,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-104949':15A,18A '-2026':14A,17A '-862':109C '6':125C '6.27.1':94C '6.27.6':96C '7':128C '7.2.1':98C '7.6.0':100C 'add':10A,31B,38B,75B,112C,120C,139C,166C,187C 'administr':73B,184C 'affect':102C 'alia':134C 'also':35B 'author':106C 'block':72B 'cannot':186C 'check':4A 'cluster':178C 'configur':68B,175C,183C 'connect':57B,161C 'coordin':32B,63B,113C,170C 'cve':13A,16A 'cwe':108C 'data':20B,86B,199C 'data-warehous':19B 'entri':64B,71B,171C,197C 'expos':89B,202C 'fake':11A,61B,70B,168C,196C 'function':34B,116C,142C 'gp':30B,37B,66B,111C,119C,173C 'host':26B 'insert':59B 'keep':129C 'let':5A 'low':7A,49B,151C 'low-privileg':6A,48B,150C 'master':39B,121C 'miss':2A,105C 'mode':56B,160C 'modifi':91B,204C 'name':36B,118C,131C 'open':156C 'packag':22B 'postgr':23B 'privileg':3A,8A,50B,148C,152C 'real':77B,189C 'remov':82B,141C,194C 'requir':43B,146C 'right':45B 'segment':67B,138C,174C 'self':25B 'self-host':24B 'standbi':12A,33B,40B,62B,78B,114C,122C,169C,182C,190C 'superus':44B,81B,147C,193C 'unlik':135C 'use':163C 'user':9A,51B,85B,153C,198C 'util':55B,159C 'utility-mod':54B,158C 'vulner':107C 'warehous':21B 'warehousepg':1A,27B,28B,92C 'whpg':93C,124C,127C","nicknames":[],"mitigations":[],"who_affected":"Clusters running WarehousePG 6.27.1 through 6.27.6 or 7.2.1 through 7.6.0 are exposed, and the risk is that any role able to open a utility-mode connection can call the function. Clusters with no standby configured are the ones where the fake entry takes effect. Teams on other WarehousePG versions or on other Greenplum-derived databases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T14:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"20be33e2-bf35-4d13-8fad-18bd2f3e3659","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104949","severity":null,"published_at":"2026-10-21T14:17:09+00:00","modified_at":"2026-10-22T16:58:51+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-104949","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104949","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}