Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104948

Quick assessment

Affected
EnterpriseDB WarehousePG
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WarehousePG (WHPG) 6.27.1 至 6.27.6 以及 7.2.1 至 7.6.0 版本受内置集群扩展函数 gp_expand_lock_catalog() 和 gp_expand_bump_version() 中缺少授权检查的漏洞影响（CWE-862）。任何已认证的数据库角色均可调用这两个函数，且函数内部均未进行权限验证。 低权限用户可在一个未提交的事务中调用 gp_expand_lock_catalog()，从而在整个集群范围内阻止所有用户（包括超级用户）对目录（catalog）进行任何变更

CVSS 7.1 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
EnterpriseDB WarehousePG 6.27.1< 6.27.7 affected
7.2.1< 7.6.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104948

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gp_expand_lock_catalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gp_expand_bump_version() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
EnterpriseDB WarehousePG 6.27.1 ~ 6.27.7 -

II. Public POCs for CVE-2026-104948

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104948

请登录查看更多情报信息。

Other References for CVE-2026-104948 (1)

Same Patch Batch · EnterpriseDB · 2026-10-21 · 3 CVEs total

CVE-2026-104947 5.3 MEDIUM WarehousePG 7.2.1-7.6.0 缺少授权漏洞
CVE-2026-104949 2.3 LOW WarehousePG 6-7 版本 gp_add_coordinator_standby 缺少授权漏洞

IV. Related Vulnerabilities

Same product: WarehousePG
Same vendor: EnterpriseDB
Same weakness: CWE-862

V. Comments for CVE-2026-104948

No comments yet

Leave a comment