CVE-2026-104949 EnterpriseDB CVE debrief

Who should care

Defenders and administrators of WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 should assess exposure and verify the configuration of their clusters. They should prioritize verifying and removing any unauthorized standby coordinator entries and ensure that only authorized users can modify the gp_segment_configuration. Additionally, they should monitor for suspicious activity related to the gp_add_coordinator_standby() function and review

Why it matters

The missing authorization vulnerability in WarehousePG allows a low-privileged user to add a fake standby coordinator entry, preventing administrators from adding a real standby until a superuser removes the fake entry. Defenders should prioritize verifying and removing any unauthorized standby coordinator entries, and ensure that only authorized users can modify the gp_segment_configuration.

• Defenders must verify and remove unauthorized standby coordinator entries to prevent potential disruptions.
• Administrators need to ensure that only authorized users can modify the gp_segment_configuration to prevent similar vulnerabilities.
• The vulnerability allows a low-privileged user to add a fake standby coordinator entry, which can prevent administrators from adding a real standby.

Technical summary

The gp_add_coordinator_standby() function in WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 does not require superuser privileges, allowing a low-privileged user to add a fake standby coordinator entry to gp_segment_configuration. This vulnerability, identified as CWE-862, can prevent administrators from adding a real standby until a superuser removes the fake entry. The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. The vulnerability impacts the configuration of gp_segment_configuration, potentially disrupting cluster operations.

Defensive priority

Defenders should prioritize verifying and removing any unauthorized standby coordinator entries, and ensure that only authorized users can modify the gp_segment_configuration.

Recommended defensive actions

• Verify and remove any unauthorized standby coordinator entries
• Ensure that only authorized users can modify the gp_segment_configuration
• Monitor for suspicious activity related to the gp_add_coordinator_standby() function
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to vendor documentation. The vulnerability is identified as CWE-862, and it affects specific versions of WarehousePG. The source item and CVE record do not provide additional information on exploitation or affected systems. Defenders should verify the configuration of their clusters and ensure that only authorized users can modify the gp_segment_configuration.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.