CVE-2026-104948 Details

A missing authorization vulnerability has been identified in WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0. The vulnerability exists in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Any authenticated database role can execute these functions, as they do not require privilege checks. A low-privileged user can use gp_expand_lock_catalog() within an open transaction to block all catalog changes across the cluster for all users, including superusers, until the transaction is completed. This effectively requires a superuser to terminate the session. The blocked changes encompass DDL operations, temporary table creation, and certain role management commands. Additionally, the same user can repeatedly invoke gp_expand_bump_version(), which disrupts sessions holding temporary tables and forces other sessions to rebuild their segment connections.

Users must upgrade to WarehousePG version 6.27.7 or later, or version 7.6.1 or later. As an immediate mitigation, superusers can revoke execute permissions on the gp_expand_lock_catalog() and gp_expand_bump_version() functions from the public role in all user databases, as well as the postgres and template1 databases.