Missing Authorization Vulnerability in WarehousePG by EnterpriseDB

CVE-2026-104947

What is CVE-2026-104947?

WarehousePG, versions 7.2.1 to 7.6.0, contains a missing authorization vulnerability in the function gp_log_backend_memory_contexts(). This flaw allows any authenticated database role to execute the function without appropriate privileges, bypassing PostgreSQL's superuser restrictions. As a result, low-privileged users can access memory context details of other sessions, including those of superuser sessions, which may expose sensitive information like cached queries. This vulnerability poses a significant risk as it enables unauthorized users to generate extensive log outputs, potentially leading to information leakage.

References