First Published: 2026/10/30
Last Updated: 2026/10/30
Summary
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can use it to add a fake standby coordinator entry to gp_segment_configuration on a cluster that has no standby configured. Administrators then cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.
Vulnerability details
CVE-ID: CVE-2026-104949
CVSS Base Score: 2.3 Low
CVSS Temporal Score: Undefined
CVSS Environmental Score: Undefined
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products and versions
- Affected Product: WarehousePG
- Affected Versions: WarehousePG 6.27.1 through 6.27.6, and WarehousePG 7.2.1 through 7.6.0
- Not Affected: Clusters that already have a standby coordinator configured
Remediation/fixes
Impacted users must upgrade to a fixed version of WarehousePG.
| Product | VRMF | Remediation/First Fix |
|---|---|---|
| WarehousePG | 6.27.1 through 6.27.6 | Update to WarehousePG 6.27.7 or later |
| WarehousePG | 7.2.1 through 7.6.0 | Update to WarehousePG 7.6.1 or later |
Immediate mitigation for existing clusters
Until you can upgrade, apply the following as a superuser in every connectable database (all user databases, postgres, and template1, so that new databases inherit the change).
WarehousePG 7:
REVOKE EXECUTE ON FUNCTION gp_add_coordinator_standby(text, text, text) FROM public; REVOKE EXECUTE ON FUNCTION gp_add_coordinator_standby(text, text, text, int4) FROM public; REVOKE EXECUTE ON FUNCTION gp_add_master_standby(text, text, text) FROM public; REVOKE EXECUTE ON FUNCTION gp_add_master_standby(text, text, text, int4) FROM public;
WarehousePG 6:
REVOKE EXECUTE ON FUNCTION gp_add_master_standby(text, text, text) FROM public; REVOKE EXECUTE ON FUNCTION gp_add_master_standby(text, text, text, int4) FROM public;
The gpinitstandby utility runs as a superuser and is not affected by this change. Restricting utility-mode connections to administrators in pg_hba.conf also reduces exposure. This is a stopgap, not a replacement for upgrading: it must be applied in every database and does not protect databases created afterward unless it was also run against template1.
References
- CVSS Calculator v4.0
- CWE-862 Missing Authorization
- warehouse-pg/warehouse-pg#324 (WarehousePG 7)
- warehouse-pg/warehouse-pg#326 (WarehousePG 6)
Related information
Acknowledgement
Source: Discovered internally by EDB while triaging a related report.
Change history
- 2026/10/30: Original Copy Published
Disclaimer
This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document is at your own risk. EDB reserves the right to change or update this document at any time. Customers are therefore recommended to always view the latest version of this document.