CVE-2026-104948 EnterpriseDB CVE debrief

Who should care

Database administrators and security teams responsible for WarehousePG deployments should assess exposure and potential impact. They should verify the authentication and authorization controls in place and evaluate the role of gp_expand_lock_catalog() and gp_expand_bump_version() in their environment. Additionally, they should implement compensating controls and monitor for suspicious activity related to these functions to mitigate potential risks.

Why it matters

Defenders should care about CVE-2026-104948 because it affects WarehousePG, allowing low-privileged users to block catalog changes or disconnect sessions, requiring verification of exposure and assessment of potential impact.

• Potential disruption of catalog changes across the cluster.
• Possible disconnection of sessions holding temporary tables.
• Requirement for superuser intervention to terminate sessions.
• Need for verification of authentication and authorization controls.

Technical summary

The vulnerability allows an authenticated database role to run gp_expand_lock_catalog() and gp_expand_bump_version() without privilege checks, potentially blocking catalog changes or disconnecting sessions. This is due to a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions of WarehousePG. The functions can be exploited to block catalog changes or disconnect sessions holding temporary tables, impacting database operations and requiring superuser intervention to resolve issues.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authentication and authorization controls.

Recommended defensive actions

• Verify exposure by checking current WarehousePG versions and authentication configurations.
• Assess potential impact by evaluating the role of gp_expand_lock_catalog() and gp_expand_bump_version() in the environment.
• Implement compensating controls to limit the use of gp_expand_lock_catalog() and gp_expand_bump_version().
• Monitor for suspicious activity related to these functions.
• Review vendor guidance for patching or mitigating the vulnerability.
• Conduct an exposure review to identify potentially affected systems.
• Track exceptions and retest remediated assets to ensure vulnerability resolution.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. The vulnerability is confirmed in WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0. The gp_expand_lock_catalog() and gp_expand_bump_version() functions are vulnerable to exploitation by authenticated database roles without privilege checks. Evidence limits are based on the CVE record and source item information, with no additional unsupported facts or claims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.