CVE-2026-104949: CWE-862 Missing Authorization in EnterpriseDB WarehousePG
Description
EnterpriseDB WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 contain a missing authorization vulnerability in the gp_add_coordinator_standby() function (also known as gp_add_master_standby() in version 6). This flaw allows a low-privileged user with utility-mode connection access to add a fake standby coordinator entry to the cluster configuration. This prevents administrators from adding a legitimate standby coordinator until the fake entry is removed by a superuser. No user data is exposed or altered by this vulnerability.
CVSS v4.0
Score 2.3low
Affected software
EnterpriseDB
WarehousePG
pkg:github/WarehousePGRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104949 is a missing authorization vulnerability (CWE-862) in EnterpriseDB WarehousePG affecting versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0. The vulnerable function gp_add_coordinator_standby() (alias gp_add_master_standby() in version 6) does not require superuser privileges, unlike other segment add/remove functions. This allows a low-privileged user who can open a utility-mode connection to insert a fake standby coordinator entry into gp_segment_configuration on clusters without an existing standby. This disrupts cluster management by blocking the addition of a real standby until a superuser removes the fake entry. The vulnerability does not lead to data exposure or modification.
Potential Impact
The vulnerability allows low-privileged users to interfere with cluster configuration by adding fake standby coordinator entries, which blocks administrators from adding legitimate standby coordinators. This can cause operational disruption but does not compromise user data confidentiality or integrity.
Mitigation Recommendations
No official patch or fix is currently documented. Administrators should monitor for unauthorized standby coordinator entries and remove any fake entries using superuser privileges. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EDB
- Date Reserved
- 2026-10-02T17:51:49.010Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad8c5a24d27ba8daab0d95d
Added to database: 10/21/2026, 14:01:06 UTC
Last enriched: 10/21/2026, 14:16:45 UTC
Last updated: 10/21/2026, 14:16:45 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.