CVE-2026-29089 - Vulnerability Analysis

Overview

TimescaleDB 2.23.0 to 2.25.1 contains a command injection caused by user-writable schemas in search_path allowing function shadowing during extension upgrade, letting malicious users execute arbitrary code, exploit requires user writable schema access.

Severity & Score

Impact

Malicious users can execute arbitrary code during extension upgrade, potentially compromising the database server.

Mitigation

Upgrade to version 2.25.2 or later.

References

• https://github.com/timescale/timescaledb/releases/tag/2.25.2
• https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m
• https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3
• https://github.com/timescale/timescaledb/pull/9331

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-29089 - High (8.8) TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, oper... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29089/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner