Arbitrary Code Execution in TimescaleDB PostgreSQL Extension

CVE-2026-29089

What is CVE-2026-29089?

TimescaleDB, a high-performance time-series database extension for PostgreSQL, contains a vulnerability that permits a malicious user to execute arbitrary code. This issue arises when using the search_path setting, which allows the inclusion of user-writable schemas. If vulnerable versions (2.23.0 to 2.25.1) are in use, a malicious actor can create functions that overshadow built-in PostgreSQL functions. Consequently, these custom functions may be invoked instead of the intended ones during an extension upgrade. This vulnerability has been addressed in version 2.25.2, ensuring enhanced security for users.

References