TI-2026-78790 Aliases CVE-2026-104947 GHSA-wmcm-w9hg-7hch

WarehousePG missing authorization lets users write server logs

LOW 23CWE-862Published 2026-10-21 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

WarehousePG (WHPG) from 7.2.1 before 7.6.1 is affected by a missing authorization flaw (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT, bypassing the superuser restriction that PostgreSQL places on pg_log_backend_memory_contexts(). A low-privileged user can force the segment backends of other sessions, including superuser sessions, to write their memory context details to the segment server logs, which the attacker cannot read. Repeated calls can generate large amounts of log output.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Those details can include query text from other users' cached plans, and the call can be repeated to generate large amounts of log output. WarehousePG 6.x is not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00216 12th percentileScored 2026-11-07

Fix Fixed WarehousePG (EnterpriseDB): 7.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
EnterpriseDB	WarehousePG	7.2.1 to before 7.6.1	7.6.1	Patch available	CNA

WarehousePG VendorEnterpriseDB Affected 7.2.1 to before 7.6.1 Fixed in 7.6.1 Patch available CNA

Remediation

Upgrade WarehousePG to version 7.6.1 or later, which fixes the flaw. The sources do not list a vendor advisory identifier for this fix. WarehousePG 6.x is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA WarehousePG (EnterpriseDB) Fixed in 7.6.1

Timeline

2026-10-21 Threatist record created from CVE-2026-104947
2026-10-21 Alias added: GHSA-wmcm-w9hg-7hch
2026-10-30 CISA SSVC decision points changed

References

Other 1

https://www.enterprisedb.com/docs/security/advisories/cve2026104947/

TI-2023-21738 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1CRITICAL 9.8
TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical… CVSS 4.0CRITICAL 9.0
TI-2026-37399 SQL injection in EnterpriseDB pglogical CVSS 4.0CRITICAL 9.0
TI-2023-21739 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1HIGH 8.8
TI-2026-63799 WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation CVSS 4.0HIGH 8.7
TI-2023-21740 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1HIGH 8.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences