CVE-2026-29089

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-29089

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29089.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-29089

Aliases

GHSA-vgp2-jj5c-828m

Published

2026-03-06T17:06:34.486Z

Modified

2026-07-15T01:49:10.487118576Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

TimescaleDB uses untrusted search path during extension upgrade

Details

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the searchpath setting to locate unqualified database objects (tables, functions, operators). If the searchpath includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.

Database specific

{
    "cwe_ids": [
        "CWE-426"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29089.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/timescale/timescaledb

Affected ranges

Type

GIT

Repo

https://github.com/timescale/timescaledb

Events

Introduced

ba5dcfd1c69f3529d0cc9de3028e1a12a36042ba

Fixed

3d9e005987643878a0cd51da40abbf7d3a63d453

Fixed

9a8f7f8bdeb99e6abae0786ffe526791a8628ce3

Database specific

{
    "cpe": "cpe:2.3:a:timescale:timescaledb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.23.0"
        },
        {
            "fixed": "2.25.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29089.json"