WarehousePG CVE-2026-104947

Requires an authenticated database connection with any low-privileged role on WarehousePG 7.2.1 through 7.6.0 (6.x is not affected); no GRANT on gp_log_backend_memory_contexts() and no superuser privileges are needed, so default installations are exploitable by any valid login. The limiting factor is that the attacker must already possess a working database role - there is no unauthenticated path (PR:L) and no user interaction. Realistic risk is therefore concentrated in multi-tenant or shared clusters where low-privilege logins are issued to untrusted users; single-tenant deployments with only trusted roles face little practical exposure.

This is a genuine but modest-priority issue, not a high-impact emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores 5.3 (Medium) and is internally consistent with the description: exploitation is network-reachable but requires an authenticated, low-privileged database role (PR:L), and the only direct scored impact is low availability (VA:L) from log flooding. No confidentiality impact is scored (VC:N) because, per the description, the attacker forces memory-context details into segment server logs the attacker cannot read - so any leakage of other users' cached query plan text benefits a defender/log-reader or a separately privileged party, not the caller directly; this is an indirect confidentiality concern that the CVSS vector deliberately does not credit. No EPSS score, KEV listing, or POC was provided in the input: exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals - CVSS, CWE-862 (missing authorization), and the description all agree this is an authorization bypass by an already-authenticated low-privilege user. Net: a legitimately valid finding worth patching in multi-tenant WHPG clusters (where low-privilege roles are untrusted), but low real-world urgency given no exploitation evidence, authentication requirement, and availability-only scored impact.

A multi-tenant WarehousePG cluster grants ordinary analysts low-privilege login roles. One such user repeatedly calls gp_log_backend_memory_contexts() against other sessions - including superuser sessions - forcing their segment backends to dump memory context details (which can contain other users' cached query-plan text) into segment server logs and generating large volumes of log output. No public exploit code was identified at time of analysis; exploitation requires only a valid authenticated database role (PR:L) and no GRANT.