WarehousePG EUVD-2026-107263

Requires a valid authenticated database role of any privilege level (PR:L) on an affected WarehousePG cluster - the vulnerable gp_expand_lock_catalog() and gp_expand_bump_version() functions are built-in and callable by any role by default on versions 6.27.1-6.27.6 and 7.2.1-7.6.0, so no non-default configuration is needed. The limiting factor is that the attacker must already hold database credentials (no unauthenticated path) and have network reachability to the cluster; there is no user-interaction requirement. Recovery from the gp_expand_lock_catalog() lock requires a superuser to terminate the offending session, so the practical impact is a sustained outage until administrators intervene.

This is a genuine availability-focused denial-of-service issue, not a confidentiality/integrity breach. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low attack complexity, requires only a low-privileged authenticated database role, no user interaction, and impact is purely high availability (VA:H) with no confidentiality or integrity effect. The 7.1 base score is driven entirely by the availability impact combined with ease of exploitation. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced - so despite the moderate-to-high CVSS, there is no evidence of real-world exploitation and no exploit code in the wild. The realistic priority is moderate: the barrier (a valid authenticated DB login) means this is primarily an insider / compromised-credential / multi-tenant abuse threat rather than an internet-wide risk, but the cluster-wide blast radius (affecting superusers and all sessions, requiring superuser intervention to recover) makes it meaningful in shared or hostile-tenant deployments. Note a labeling discrepancy: the input tags this 'Authentication Bypass', but the described flaw is missing authorization (CWE-862) abusable by an already-authenticated user - verify the classification, as it changes the threat model.

A legitimate but low-privileged user (or an attacker who has obtained ordinary database credentials) in a shared WarehousePG cluster opens a transaction and calls gp_expand_lock_catalog(), freezing all catalog changes (DDL, temp table creation, GRANT, CREATE ROLE) for every user including superusers until that session is forcibly terminated. Alternatively they repeatedly invoke gp_expand_bump_version() to disconnect sessions holding temp tables with FATAL errors and force all other sessions to rebuild segment connections, degrading the cluster. No public exploit code is identified at time of analysis, but the attack requires only a single SQL function call with no special tooling.