CVE-2026-29089 Details
Description
TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.
A vulnerability in TimescaleDB versions 2.23.0 prior to 2.25.1 allows low-privileged users to execute arbitrary code by exploiting the search_path setting during extension upgrades. When the search_path includes user-writable schemas, a malicious user can create functions that override built-in PostgreSQL functions. This issue has been addressed in TimescaleDB version 2.25.2.
Users are advised to upgrade to TimescaleDB version 2.25.2. For those on Tiger Cloud or the Managed Service for TimescaleDB, the vulnerability is not exploitable due to additional security measures.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3 | [email protected] | Patch |
| https://github.com/timescale/timescaledb/pull/9331 | [email protected] | Issue TrackingPatch |
| https://github.com/timescale/timescaledb/releases/tag/2.25.2 | [email protected] | ProductRelease Notes |
| https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| timescale timescaledb | >= 2.23.0, < 2.25.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |