PT-2026-23731 · Timescale · Timescaledb

Svenklem · Publicado 2026-03-06 · Atualizado 2026-03-07 · CVE-2026-29089

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TimescaleDB versions 2.23.0 through 2.25.1

Description TimescaleDB is a time-series database that functions as a Postgres extension. A flaw exists where PostgreSQL’s use of the search path setting can allow a malicious user to create functions in user-writable schemas. These functions can shadow built-in Postgres functions and be executed instead during extension upgrades, potentially leading to arbitrary code execution. The issue stems from unqualified database object lookups when the search path includes schemas accessible for writing.

Recommendations Upgrade to TimescaleDB version 2.25.2 or later.

Exploit

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2026-29089

GHSA-VGP2-JJ5C-828M

Produtos afetados

Timescaledb

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29089.json · Exploit
• https://github.com/timescale/timescaledb/commit/9a8f7f8bdeb99e6abae0786ffe526791a8628ce3 · Correção
• https://github.com/timescale/timescaledb/pull/9331 · Correção
• https://github.com/timescale/timescaledb/security/advisories/GHSA-vgp2-jj5c-828m · Aviso do Fabricante
• https://github.com/timescale/timescaledb/releases/tag/2.25.2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-29089 · Nota de Segurança
• https://twitter.com/CVEnew/status/2029975476035522774 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2030214356965937316 · Publicação no Twitter
• https://t.me/CVEtracker/46633 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-29089 · Aviso do Fabricante