Enterprisedb
Monthly
WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 permits any authenticated database role to invoke built-in cluster-expansion functions that perform no privilege check, enabling a low-privileged user to hold catalog locks cluster-wide or repeatedly force session reconnections. The result is a sustained availability outage - DDL, temporary table creation, GRANT and CREATE ROLE are blocked until a superuser terminates the offending session - rather than data disclosure or modification. No public exploit code has been identified at time of analysis, although exploitation only requires valid database credentials and network reachability to the cluster.
Deletion of arbitrary cloud snapshots on AWS, Microsoft Azure, or Google Cloud can be triggered through Barman 3.4.0/3.6.0/3.7.0 (per provider) through 3.20.0, because the snapshot deletion path reads snapshot identifiers from the backup catalog (backup.info) and passes them to the cloud provider's delete API using Barman's own credentials without verifying that those snapshots belong to the backup being removed. An authenticated, low-privileged principal who can overwrite backup.info but does not hold snapshot-delete permissions can substitute the identifiers of unrelated snapshots, causing Barman to delete any snapshot its cloud identity can reach; deletion occurs either on explicit backup deletion or automatically when a retention policy is enforced, so no further admin action is needed once the forged catalog entry exists. Exploitation is conditional, not universal: it requires a deployment in which the principal that writes the backup catalog is separate from the cloud identity Barman uses to delete snapshots, and single-identity deployments are not exploitable (CVSS 4.0 base 7.2). No public exploit code has been identified at time of analysis, and the vendor-released fix is Barman 3.20.1.
Missing authorization in WarehousePG (WHPG) 7.x before 7.6.0-WHPG lets any authenticated database role - with no superuser rights, no GRANT, and no special role membership - call the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink and pg_logdir_ls, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived _v1_1 implementations during the merge onto a PostgreSQL 12 base. An attacker holding ordinary database credentials can therefore create, append to, overwrite, rename and delete files under the data and log directories and enumerate log file names, and by appending directives such as shared_preload_libraries or archive_command to postgresql.auto.conf can achieve arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected because its equivalent functions enforce an internal superuser check, and no public exploit code has been identified at time of analysis (no CISA KEV entry).
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 allow an authenticated low-privileged user who can open a utility-mode connection to invoke gp_add_coordinator_standby(), named gp_add_master_standby() in WHPG 6 and kept as an alias in WHPG 7, without the superuser check enforced by sibling segment add/remove functions. On a cluster with no standby coordinator configured, this creates a fake gp_segment_configuration entry that blocks administrators from adding a real standby until a superuser removes it. The issue is low severity and limited to integrity and availability impact with no user-data exposure; no public exploit was identified at time of analysis and it is not confirmed actively exploited (CISA KEV).
Missing authorization in WarehousePG 7.2.1 through 7.6.0 allows any authenticated, low-privileged database role to call gp_log_backend_memory_contexts() without a GRANT and bypass the superuser-only restriction on PostgreSQL's underlying pg_log_backend_memory_contexts(). An attacker with a valid login can force segment backends for other sessions, including superuser sessions, to write memory-context details such as cached query text into segment server logs they cannot read, and can repeat the call to amplify log volume. No public exploit code or confirmed active exploitation is identified in the provided intelligence, and the assessed impact is limited to low availability loss with no confidentiality or integrity impact within the vulnerable component.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Postgres Enterprise Manager versions up to 9.8.1 is affected by cross-site scripting (xss) (CVSS 6.5).
Unauthenticated network access to specific gRPC endpoints in EDB Hybrid Manager can be achieved because those endpoints were never declared in the Istio Gateway's authorization policy, letting requests bypass both authentication and authorization (CWE-306). Attackers with network reachability to the affected gRPC service can read potentially sensitive data (C:L) or push malformed payloads that degrade or deny service (A:H); the independent assessment scores this AV:N/AC:L/PR:N/UI:N at 7.0, i.e. no credentials are required, though only the omitted endpoints are exposed while correctly declared endpoints remain protected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is fixed in Hybrid Manager LTS 1.3.3 and Innovation 2025.12, so patched instances are not exploitable.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 permits any authenticated database role to invoke built-in cluster-expansion functions that perform no privilege check, enabling a low-privileged user to hold catalog locks cluster-wide or repeatedly force session reconnections. The result is a sustained availability outage - DDL, temporary table creation, GRANT and CREATE ROLE are blocked until a superuser terminates the offending session - rather than data disclosure or modification. No public exploit code has been identified at time of analysis, although exploitation only requires valid database credentials and network reachability to the cluster.
Deletion of arbitrary cloud snapshots on AWS, Microsoft Azure, or Google Cloud can be triggered through Barman 3.4.0/3.6.0/3.7.0 (per provider) through 3.20.0, because the snapshot deletion path reads snapshot identifiers from the backup catalog (backup.info) and passes them to the cloud provider's delete API using Barman's own credentials without verifying that those snapshots belong to the backup being removed. An authenticated, low-privileged principal who can overwrite backup.info but does not hold snapshot-delete permissions can substitute the identifiers of unrelated snapshots, causing Barman to delete any snapshot its cloud identity can reach; deletion occurs either on explicit backup deletion or automatically when a retention policy is enforced, so no further admin action is needed once the forged catalog entry exists. Exploitation is conditional, not universal: it requires a deployment in which the principal that writes the backup catalog is separate from the cloud identity Barman uses to delete snapshots, and single-identity deployments are not exploitable (CVSS 4.0 base 7.2). No public exploit code has been identified at time of analysis, and the vendor-released fix is Barman 3.20.1.
Missing authorization in WarehousePG (WHPG) 7.x before 7.6.0-WHPG lets any authenticated database role - with no superuser rights, no GRANT, and no special role membership - call the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink and pg_logdir_ls, because the REVOKE that contrib/adminpack applies to the equivalent functions was never carried over to WHPG core when their catalog entries were repointed to the ungated adminpack-derived _v1_1 implementations during the merge onto a PostgreSQL 12 base. An attacker holding ordinary database credentials can therefore create, append to, overwrite, rename and delete files under the data and log directories and enumerate log file names, and by appending directives such as shared_preload_libraries or archive_command to postgresql.auto.conf can achieve arbitrary code execution as the postgres operating system user on the next server restart or configuration reload. WarehousePG 6.x is not affected because its equivalent functions enforce an internal superuser check, and no public exploit code has been identified at time of analysis (no CISA KEV entry).
Remote code execution in pglogical extension for PostgreSQL allows a low-privileged user to crash replication workers, with potential for arbitrary code execution. A use-after-free condition in worker signaling code is triggered during normal replication operations when worker lifecycle events race. While typical effect is denial-of-service, a successful exploit can give complete control of the database backend process.
Privilege escalation in pglogical allows a publisher to execute functions as superuser on the subscriber by exploiting default expression evaluation during replication of rows with missing columns. This affects deployments where non-superuser roles are permitted to create subscriptions, such as managed PostgreSQL services. No public exploit is known, and the path is distinct from CVE-2026-50736.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
WarehousePG 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 allow an authenticated low-privileged user who can open a utility-mode connection to invoke gp_add_coordinator_standby(), named gp_add_master_standby() in WHPG 6 and kept as an alias in WHPG 7, without the superuser check enforced by sibling segment add/remove functions. On a cluster with no standby coordinator configured, this creates a fake gp_segment_configuration entry that blocks administrators from adding a real standby until a superuser removes it. The issue is low severity and limited to integrity and availability impact with no user-data exposure; no public exploit was identified at time of analysis and it is not confirmed actively exploited (CISA KEV).
Missing authorization in WarehousePG 7.2.1 through 7.6.0 allows any authenticated, low-privileged database role to call gp_log_backend_memory_contexts() without a GRANT and bypass the superuser-only restriction on PostgreSQL's underlying pg_log_backend_memory_contexts(). An attacker with a valid login can force segment backends for other sessions, including superuser sessions, to write memory-context details such as cached query text into segment server logs they cannot read, and can repeat the call to amplify log volume. No public exploit code or confirmed active exploitation is identified in the provided intelligence, and the assessed impact is limited to low availability loss with no confidentiality or integrity impact within the vulnerable component.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Postgres Enterprise Manager versions up to 9.8.1 is affected by cross-site scripting (xss) (CVSS 6.5).
Unauthenticated network access to specific gRPC endpoints in EDB Hybrid Manager can be achieved because those endpoints were never declared in the Istio Gateway's authorization policy, letting requests bypass both authentication and authorization (CWE-306). Attackers with network reachability to the affected gRPC service can read potentially sensitive data (C:L) or push malformed payloads that degrade or deny service (A:H); the independent assessment scores this AV:N/AC:L/PR:N/UI:N at 7.0, i.e. no credentials are required, though only the omitted endpoints are exposed while correctly declared endpoints remain protected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issue is fixed in Hybrid Manager LTS 1.3.3 and Innovation 2025.12, so patched instances are not exploitable.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.