CVE-2026-104949 Details

A missing authorization vulnerability has been identified in WarehousePG (WHPG) versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0. The vulnerability exists in the gp_add_coordinator_standby() function, which is aliased as gp_add_master_standby() in WHPG 6. This function, unlike other segment management functions, does not require superuser privileges. As a result, a low-privileged user with access to a utility-mode connection can exploit this vulnerability to add a fraudulent standby coordinator entry to the gp_segment_configuration of a cluster without an existing standby. This interference prevents administrators from adding a legitimate standby until the fake entry is removed by a superuser. Notably, this vulnerability does not expose or alter user data.

Users must upgrade to WarehousePG 6.27.7 or later if they are using WarehousePG 6.27.1 through 6.27.6, or to WarehousePG 7.6.1 or later if they are using WarehousePG 7.2.1 through 7.6.0. As an immediate mitigation, superusers can revoke execute permissions on the gp_add_coordinator_standby and gp_add_master_standby functions from the public role in all user databases, as well as the postgres and template1 databases.