TI-2026-78791 Aliases CVE-2026-104948 GHSA-7m66-9h4j-25fj

WarehousePG missing authorization in cluster expansion functions

LOW 31CWE-862Published 2026-10-21 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

WarehousePG versions from 6.27.1 before 6.27.7 and from 7.2.1 before 7.6.1 are affected by CWE-862 Missing Authorization in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can call them, and neither checks privileges. A low-privileged user can run gp_expand_lock_catalog() inside an open transaction to block catalog changes across the cluster for all users, including superusers, until that transaction ends. Repeated calls to gp_expand_bump_version() disconnect sessions that hold temporary tables and force other sessions to rebuild their segment connections.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00216 12th percentileScored 2026-11-07

Fix Fixed WarehousePG (EnterpriseDB): 6.27.7, 7.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
EnterpriseDB	WarehousePG	6.27.1 to before 6.27.7; 7.2.1 to before 7.6.1	6.27.7, 7.6.1	Patch available	CNA

WarehousePG VendorEnterpriseDB Affected 6.27.1 to before 6.27.7; 7.2.1 to before 7.6.1 Fixed in 6.27.7, 7.6.1 Patch available CNA

Remediation

Upgrade to WarehousePG 6.27.7 or 7.6.1, which contain the fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA WarehousePG (EnterpriseDB) Fixed in 6.27.7, 7.6.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-21
EnterpriseDB WarehousePG 6.27.7, 7.6.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-78792 Missing authorization in WarehousePG standby coordinator functionPriority LOW 12
Show all 2 records →

Timeline

2026-10-21 Threatist record created from CVE-2026-104948
2026-10-21 Alias added: GHSA-7m66-9h4j-25fj
2026-10-23 Priority changed: MEDIUM → LOW
2026-10-30 CISA SSVC decision points changed

References

Other 1

https://www.enterprisedb.com/docs/security/advisories/cve2026104948/

TI-2023-21738 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1CRITICAL 9.8
TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical… CVSS 4.0CRITICAL 9.0
TI-2026-37399 SQL injection in EnterpriseDB pglogical CVSS 4.0CRITICAL 9.0
TI-2023-21739 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1HIGH 8.8
TI-2026-63799 WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation CVSS 4.0HIGH 8.7
TI-2023-21740 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1HIGH 8.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences