Missing Authorization in WarehousePG Affects Standby Coordinator Functionality
CVE-2026-104949

2.3LOW

Key Information:

Vendor

Enterprisedb

Status
Warehousepg
Vendor
CVE Published:
21 October 2026

What is CVE-2026-104949?

WarehousePG versions 6.27.1 to 6.27.6 and 7.2.1 to 7.6.0 are susceptible to a missing authorization issue in the gp_add_coordinator_standby() function. This vulnerability allows a low-privileged user to create unauthorized entries in the gp_segment_configuration for a cluster lacking a standby coordinator. As the function does not enforce superuser privileges, it can be exploited to insert a fake standby coordinator entry. This prevents administrators from adding an actual standby coordinator until the malicious entry is removed by a superuser. Note that user data remains unharmed throughout this process.

Affected Version(s)

WarehousePG 6.27.1 < 6.27.7

WarehousePG 7.2.1 < 7.6.1

References

https://www.enterprisedb.com/docs/security/advisories/cve...

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.