CVE-2026-29089

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29089", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T21:54:06.707Z", "datePublished": "2026-03-06T17:06:34.486Z", "dateUpdated": "2026-03-11T03:56:36.996Z"}, "containers": {"cna": {"title": "TimescaleDB uses untrusted search path during extension upgrade", "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m"}, {"name": "https://github.com/timescale/timescaledb/pull/9331", "tags": ["x_refsource_MISC"], "url": "https://github.com/timescale/timescaledb/pull/9331"}, {"name": "https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3", "tags": ["x_refsource_MISC"], "url": "https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3"}, {"name": "https://github.com/timescale/timescaledb/releases/tag/2.25.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/timescale/timescaledb/releases/tag/2.25.2"}], "affected": [{"vendor": "timescale", "product": "timescaledb", "versions": [{"version": ">= 2.23.0, < 2.25.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:06:34.486Z"}, "descriptions": [{"lang": "en", "value": "TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2."}], "source": {"advisory": "GHSA-vgp2-jj5c-828m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-29089"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T03:56:36.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29089", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T17:57:04.059018Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T17:57:12.804Z"}}], "cna": {"title": "TimescaleDB uses untrusted search path during extension upgrade", "source": {"advisory": "GHSA-vgp2-jj5c-828m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "timescale", "product": "timescaledb", "versions": [{"status": "affected", "version": ">= 2.23.0, < 2.25.2"}]}], "references": [{"url": "https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m", "name": "https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/timescale/timescaledb/pull/9331", "name": "https://github.com/timescale/timescaledb/pull/9331", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3", "name": "https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/timescale/timescaledb/releases/tag/2.25.2", "name": "https://github.com/timescale/timescaledb/releases/tag/2.25.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426: Untrusted Search Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T17:06:34.486Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29089", "state": "PUBLISHED", "dateUpdated": "2026-03-11T03:56:36.996Z", "dateReserved": "2026-03-03T21:54:06.707Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T17:06:34.486Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "timescaledb", "vendor": "timescale", "versions": [{"status": "affected", "version": ">= 2.23.0, < 2.25.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:timescale:timescaledb:*:*:*:*:*:*:*:*", "matchCriteriaId": "70D5A15A-A908-4113-B8BA-AC0A17166F76", "versionEndExcluding": "2.25.2", "versionStartIncluding": "2.23.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2."}, {"lang": "es", "value": "TimescaleDB es una base de datos de series temporales para an\u00e1lisis en tiempo real de alto rendimiento empaquetada como una extensi\u00f3n de Postgres. Desde la versi\u00f3n 2.23.0 hasta la 2.25.1, PostgreSQL utiliza la configuraci\u00f3n search_path para localizar objetos de base de datos no calificados (tablas, funciones, operadores). Si el search_path incluye esquemas escribibles por el usuario, un usuario malintencionado puede crear funciones en ese esquema que ocultan funciones integradas de postgres y ser\u00e1n llamadas en lugar de las funciones de postgres, lo que lleva a la ejecuci\u00f3n de c\u00f3digo arbitrario durante la actualizaci\u00f3n de la extensi\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 2.25.2."}], "id": "CVE-2026-29089", "lastModified": "2026-06-17T10:29:34.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29089", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-06T18:16:19.967", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/timescale/timescaledb/pull/9331"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/timescale/timescaledb/releases/tag/2.25.2"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "timescaledb: TimescaleDB: Arbitrary code execution via malicious functions in user-writable schemas during extension upgrade", "id": "2445265", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445265"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-427", "details": ["A flaw was found in TimescaleDB, a time-series database extension for PostgreSQL. A malicious user can exploit this vulnerability by creating functions in user-writable schemas that shadow built-in PostgreSQL functions. During an extension upgrade, PostgreSQL's `search_path` setting, which determines how database objects are located, can cause these malicious functions to be executed instead of the legitimate ones. This can lead to arbitrary code execution, allowing the attacker to run unauthorized commands on the system."], "name": "CVE-2026-29089", "public_date": "2026-03-06T17:06:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-29089\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-29089\nhttps://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3\nhttps://github.com/timescale/timescaledb/pull/9331\nhttps://github.com/timescale/timescaledb/releases/tag/2.25.2\nhttps://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m"], "statement": "This IMPORTANT vulnerability affects TimescaleDB versions 2.23.0 through 2.25.1. A database user with low privileges can achieve arbitrary code execution during extension upgrade by placing malicious functions in user-writable schemas. The scope is changed as code executes in the upgrade context with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.23.0,2.25.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "timescaledb", "source": "cna", "vendor": "timescale"}, "product": "timescaledb", "vendor": "timescale"}], "analysis": {"en": {"generated_at": "2026-04-16T11:18:03.107738+00:00", "value": {"mitigation_remediation": ["Upgrade TimescaleDB to version 2.25.2 or later to remove the flaw", "Remove or rename any user\u2011defined functions that shadow PostgreSQL functions before performing an extension upgrade", "Restrict the database search_path to exclude user\u2011writable schemas during the upgrade process"], "summary": {"action": "Apply Patch", "impact": "Arbitrary Code Execution during extension upgrade"}, "threat_synthesis": {"affected_systems": "The affected product is TimescaleDB, a PostgreSQL extension for time\u2011series data. All installed instances of TimescaleDB from version 2.23.0 up through 2.25.1 are vulnerable. The vendor responsible for the fix is Timescale, and the fix is incorporated in release 2.25.2.", "description_and_impact": "A flaw in TimescaleDB between versions 2.23.0 and 2.25.1 allows a PostgreSQL user who has write access to a schema that appears in the database\u2019s search_path to create a function with the same name as a built\u2011in PostgreSQL function. During an extension upgrade the server will resolve the function from the user\u2011writable schema instead of the intended PostgreSQL implementation, enabling the attacker to execute arbitrary code on the database host. This translates to a high\u2011severity vulnerability classified as CWE\u2011426 and CWE\u2011427. The impact is a complete compromise of the database system on the host where the database process runs.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of active exploitation at present. The flaw has not been listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector involves a user or application with database permissions leveraging a writable schema in the search_path; the attacker must already have database access to create the malicious function, after which the code runs with the privileges of the database server process during an upgrade. The risk is mitigated by applying the published patch, but if immediate upgrade is not feasible, deanonymizing or dropping the conflicting functions and tightening the search_path before upgrade can provide a temporary safeguard."}}}}, "created": "2026-03-09T10:07:16.365216+00:00", "updated": "2026-04-16T11:30:15.897587+00:00", "vendors": ["timescale", "timescale$PRODUCT$timescaledb"]}