Read the docs
TI-2026-23232 Aliases CVE-2026-29089

TimescaleDB uses untrusted search path during extension upgrade

Priority LOW 39CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed timescaledb (timescale): 2.25.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
timescaletimescaledb2.23.0 to before 2.25.22.25.2Patch availableCNA
  • timescaledb Vendortimescale Affected 2.23.0 to before 2.25.2 Fixed in 2.25.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:timescale:timescaledb:*:*:*:*:*:*:*:*2.23.0 to before 2.25.2Vulnerabletimescale
  • cpe:2.3:a:timescale:timescaledb:*:*:*:*:*:*:*:* Versions 2.23.0 to before 2.25.2 Vulnerable ·timescale

Remediation

  • Fix · CNA timescaledb (timescale) Fixed in 2.25.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29089

References

Patch 2

Advisory 1

Other 1

  • TI-2023-10611 TimescaleDB has incorrect access control CVSS 3.1HIGH 8.8
  • TI-2022-08073 Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during… CVSS 3.1HIGH 8.0
  • TI-2026-49345 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index CVSS 4.0HIGH 7.1
  • TI-2026-49344 TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator CVSS 4.0HIGH 7.2
  • TI-2026-49343 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences