CVE-2026-104949 WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby().
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-104949?
CVE-2026-104949 is a low-severity vulnerability in EnterpriseDB WarehousePG, published on 21 Oct 2026.
Official description
WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_standby() in WHPG 6, and WHPG 7 keeps that name as an alias. Unlike the other segment add and remove functions, it does not require superuser privileges. A low-privileged user who can open a utility-mode connection can use it to add a fake standby coordinator entry to gp_segment_configuration on a cluster that has no standby configured. Administrators then cannot add a real standby until a superuser removes the fake entry. User data is not exposed or modified.
Weakness: CWE-862
Which versions are affected by CVE-2026-104949?
How do I fix CVE-2026-104949?
No fix has been published for CVE-2026-104949 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104949 being exploited?
There is no known exploitation of CVE-2026-104949 in the wild and no public exploit code.
Sources
Also known as GHSA-6956-hw8j-vqw3.