CVE-2026-104948: WarehousePG WarehousePG vulnerability

Q: Who can exploit this issue?

Any authenticated database role, including a low-privileged user, can invoke the affected built-in functions. No privilege checks are performed by either function.

Q: What impact can an attacker cause with gp_expand_lock_catalog()?

A user can call it within an open transaction to block catalog changes cluster-wide, including for superusers. This blocks DDL, temporary table creation, GRANT, and CREATE ROLE until the transaction ends; in practice, a superuser must terminate the attacking session.

Q: What impact can an attacker cause with gp_expand_bump_version()?

Repeated calls can disconnect sessions holding temporary tables, which receive a FATAL error on their next catalog change. The calls also force every other session to rebuild its segment connections.

Q: Which versions are affected?

Affected versions are WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0.

Published Oct 21, 2026

Updated

WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gpexpandlockcatalog() and gpexpandbumpversion(). Any authenticated database role can run them, and neither checks privileges. A low-privileged user can call gpexpandlockcatalog() inside an open transaction to block all catalog changes across the cluster for every user, superusers included, until that transaction ends, which in practice requires a superuser to terminate the session. Blocked changes include DDL, temporary table creation, GRANT and CREATE ROLE. The same user can call gpexpandbumpversion() repeatedly. Each call disconnects sessions that hold temporary tables, with a FATAL error on their next catalog change, and makes every other session rebuild its segment connections.

Affected Software

1 affected component

WarehousePG WarehousePG>=6.27.1<=6.27.6, >=7.2.1<=7.6.0

Event History

Oct 21, 2026

CVE Published

via MITRE·01:53 PM

Data Sourced

via MITRE·01:53 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated database role, including a low-privileged user, can invoke the affected built-in functions. No privilege checks are performed by either function.

What impact can an attacker cause with gp_expand_lock_catalog()?

A user can call it within an open transaction to block catalog changes cluster-wide, including for superusers. This blocks DDL, temporary table creation, GRANT, and CREATE ROLE until the transaction ends; in practice, a superuser must terminate the attacking session.

What impact can an attacker cause with gp_expand_bump_version()?

Repeated calls can disconnect sessions holding temporary tables, which receive a FATAL error on their next catalog change. The calls also force every other session to rebuild its segment connections.

Which versions are affected?

Affected versions are WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0.

CVE-2026-104948: WarehousePG WarehousePG vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can an attacker cause with gp_expand_lock_catalog()?

What impact can an attacker cause with gp_expand_bump_version()?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can an attacker cause with gp_expand_lock_catalog()?

What impact can an attacker cause with gp_expand_bump_version()?

Which versions are affected?