What is the CVSS score of CVE-2026-29089?

CVE-2026-29089 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PostgreSQL are affected by CVE-2026-29089?

TimescaleDB installations running versions 2.23.0 through 2.25.1 are vulnerable to a high-severity attack that exploits PostgreSQL's search_path configuration to manipulate database object…

How to fix or mitigate CVE-2026-29089?

Within 24 hours: Inventory all TimescaleDB instances and identify those running versions 2.23.0-2.25.1; disable or restrict untrusted database user access to affected instances. Within 7 days: Implement network segmentation to limit TimescaleDB exposure, audit search_path configurations for all databases, and establish monitoring for suspicious object resolution patterns. Within 30 days: Upgrade to TimescaleDB 2.25.2 or later once patches are released, or migrate critical workloads to unaffected versions; conduct full security review of database user privileges and search_path settings.

PostgreSQL CVE-2026-29089

HIGH

Untrusted Search Path (CWE-426)

2026-03-06 security-advisories@github.com

PostgreSQL RCE Timescaledb Red Hat Suse

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 18:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.

AnalysisAI

Arbitrary code execution in TimescaleDB 2.23.0 through 2.25.1 allows local authenticated users to execute malicious functions by shadowing built-in PostgreSQL functions through user-writable schemas in the search_path setting during extension upgrades. An attacker with database access can create malicious functions in writable schemas that are invoked instead of legitimate PostgreSQL functions, resulting in code execution with database privileges. No patch is currently available for affected installations.

Technical ContextAI

Classified as CWE-426 (Untrusted Search Path). TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extensi