CVE-2026-29089 TimescaleDB uses untrusted search path during extension upgrade

What is CVE-2026-29089?

CVE-2026-29089 is a high-severity code injection vulnerability in timescaledb, published on 6 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.

Weakness: CWE-426

Which versions are affected by CVE-2026-29089?

It affects 1 product.

Products include Timescale Timescaledb.

How do I fix CVE-2026-29089?

No fix has been published for CVE-2026-29089 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-29089 being exploited?

There is no known exploitation of CVE-2026-29089 in the wild and no public exploit code.

Other vulnerabilities in timescaledb

• CVE-2023-25149 TimescaleDB has incorrect access control High 8.8
• CVE-2022-24128 Privilege escalation in n/a High 8.0
• CVE-2026-70634 TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator High 7.2
• CVE-2026-70633 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator High 7.1
• CVE-2026-70635 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vgp2-jj5c-828m.