TI-2026-78792 Aliases CVE-2026-104949 GHSA-6956-hw8j-vqw3

Missing authorization in WarehousePG standby coordinator function

LOW 12CWE-862Published 2026-10-21 · Updated 2026-10-30

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

From 6.27.1 before 6.27.7 and from 7.2.1 before 7.6.1, WarehousePG has a missing authorization flaw (CWE-862) in gp_add_coordinator_standby(). Unlike the other segment add and remove functions, it does not require superuser privileges, so a low-privileged user with a utility-mode connection can add a fake standby coordinator entry to gp_segment_configuration on a cluster with no standby. Administrators cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can use it to add a fake standby coordinator entry to gp_segment_configuration on a cluster that has no standby configured. Administrators then cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00231 13th percentileScored 2026-11-07

Fix Fixed WarehousePG (EnterpriseDB): 6.27.7, 7.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
EnterpriseDB	WarehousePG	6.27.1 to before 6.27.7; 7.2.1 to before 7.6.1	6.27.7, 7.6.1	Patch available	CNA

WarehousePG VendorEnterpriseDB Affected 6.27.1 to before 6.27.7; 7.2.1 to before 7.6.1 Fixed in 6.27.7, 7.6.1 Patch available CNA

Remediation

Fixed versions for WarehousePG are 6.27.7 and 7.6.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA WarehousePG (EnterpriseDB) Fixed in 6.27.7, 7.6.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-21
EnterpriseDB WarehousePG 6.27.7, 7.6.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-78791 WarehousePG missing authorization in cluster expansion functionsPriority LOW 31
Show all 2 records →

Timeline

2026-10-21 Threatist record created from CVE-2026-104949
2026-10-21 Alias added: GHSA-6956-hw8j-vqw3
2026-10-30 CVSS score added · CISA ADP
2026-10-30 CISA SSVC decision points changed

References

Other 1

https://www.enterprisedb.com/docs/security/advisories/cve2026104949/

TI-2023-21738 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1CRITICAL 9.8
TI-2026-37400 When applying replicated changes for a row that is missing one or more columns, pglogical… CVSS 4.0CRITICAL 9.0
TI-2026-37399 SQL injection in EnterpriseDB pglogical CVSS 4.0CRITICAL 9.0
TI-2023-21739 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1HIGH 8.8
TI-2026-63799 WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation CVSS 4.0HIGH 8.7
TI-2023-21740 An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32… CVSS 3.1HIGH 8.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences