CVE-2026-104948: CWE-862 Missing Authorization in EnterpriseDB WarehousePG

CVE-2026-104948 describes a missing authorization vulnerability (CWE-862) in EnterpriseDB's WarehousePG affecting versions >=6.27.1 <6.27.7 and >=7.2.1 <7.6.1. The built-in functions gp_expand_lock_catalog() and gp_expand_bump_version() do not verify user privileges, allowing any authenticated database role to execute them. gp_expand_lock_catalog() can be called inside an open transaction to block all catalog changes cluster-wide, including DDL, temporary table creation, GRANT, and CREATE ROLE operations, effectively causing a denial of service that requires superuser intervention to resolve. gp_expand_bump_version() can be called repeatedly to disconnect sessions holding temporary tables and force other sessions to rebuild segment connections, further disrupting cluster operations.

The vulnerability allows low-privileged authenticated users to cause denial of service by blocking catalog changes for all users, including superusers, and by disconnecting sessions holding temporary tables. This disrupts normal database operations such as schema modifications, role management, and session stability, potentially impacting availability and administrative tasks.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to WarehousePG to trusted users only and monitor for unusual use of the gp_expand_lock_catalog() and gp_expand_bump_version() functions.