CVE-2026-29089 - Vulnerability Analysis

Overview

TimescaleDB 2.23.0 to 2.25.1 contains a command injection caused by user-writable schemas in search_path allowing function shadowing during extension upgrade, letting malicious users execute arbitrary code, exploit requires user writable schema access.

Severity & Score

Impact

Malicious users can execute arbitrary code during extension upgrade, potentially compromising the database server.

Mitigation

Upgrade to version 2.25.2 or later.

References

• https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3
• https://github.com/timescale/timescaledb/pull/9331
• https://github.com/timescale/timescaledb/releases/tag/2.25.2
• https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner