CVE-2026-104947 Details
Description
WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on the underlying pg_log_backend_memory_contexts() function. A low-privileged user can force the segment backends of any other session, superuser sessions included, to write their memory context details to the segment server logs, which the attacker cannot read. Those details can include query text from other users' cached plans, and the call can be repeated to generate large amounts of log output. WarehousePG 6.x is not affected.
A missing authorization vulnerability has been identified in WarehousePG (WHPG) versions 7.2.1 through 7.6.0. The vulnerability resides in the built-in function gp_log_backend_memory_contexts(), which can be executed by any authenticated database role without the need for a GRANT. This issue bypasses the superuser restriction imposed by PostgreSQL on the underlying pg_log_backend_memory_contexts() function. As a result, a low-privileged user can manipulate the segment backends of any other session, including superuser sessions, forcing them to log memory context details to the segment server logs. While the attacker cannot read these logs, the logged information may contain query text from other users' cached plans. Furthermore, this function can be called repeatedly, generating large volumes of log output.
Users must upgrade to WarehousePG version 7.6.1 or later. As an immediate mitigation, superusers can revoke execute permissions on the gp_log_backend_memory_contexts() function from the public role in all connectable databases.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.enterprisedb.com/docs/security/advisories/cve2026104947/ | EnterpriseDB Corporation | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | EnterpriseDB Corporation |
Affected Products
| Product | Versions |
|---|---|
| WarehousePG | >= 7.2.1, <= 7.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | EnterpriseDB Corporation |