CVE-2026-29089
Description
A flaw was found in TimescaleDB, a time-series database extension for PostgreSQL. A malicious user can exploit this vulnerability by creating functions in user-writable schemas that shadow built-in PostgreSQL functions. During an extension upgrade, PostgreSQL's search_path setting, which determines how database objects are located, can cause these malicious functions to be executed instead of the legitimate ones. This can lead to arbitrary code execution, allowing the attacker to run unauthorized commands on the system.
Statement
This IMPORTANT vulnerability affects TimescaleDB versions 2.23.0 through 2.25.1. A database user with low privileges can achieve arbitrary code execution during extension upgrade by placing malicious functions in user-writable schemas. The scope is changed as code executes in the upgrade context with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
